{"type":"bundle","id":"bundle--3b1a3c4e-0680-5097-928b-98940548c105","objects":[{"type":"identity","spec_version":"2.1","id":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","created":"2020-12-08T00:00:00.000Z","modified":"2020-12-08T00:00:00.000Z","name":"TweetFeed","description":"Community-sourced Threat Intelligence feed aggregating IOCs (URLs, domains, IPs, hashes) from infosec researchers on Twitter/X. Refreshed every 15 minutes.","identity_class":"organization","contact_information":"https://tweetfeed.live"},{"type":"indicator","spec_version":"2.1","id":"indicator--007e7832-64dd-5ba3-80a6-4316a15e347d","created":"2026-05-08T00:00:00.000Z","modified":"2026-05-08T00:00:00.000Z","valid_from":"2026-05-08T00:00:00.000Z","name":"month-gasoline-seasoned.heyflow.site","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'month-gasoline-seasoned.heyflow.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052539040868536427"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6802659f-7cbc-5b7f-8b8d-76a3ce8385d7","created":"2026-05-08T00:00:00.000Z","modified":"2026-05-08T00:00:00.000Z","valid_from":"2026-05-08T00:00:00.000Z","name":"http://month-gasoline-seasoned.heyflow.site/at_t-mail-12260c","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://month-gasoline-seasoned.heyflow.site/at_t-mail-12260c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052539040868536427"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--487d0c69-b737-5b39-913c-147af59d1070","created":"2026-05-08T00:10:00.000Z","modified":"2026-05-08T00:10:00.000Z","valid_from":"2026-05-08T00:10:00.000Z","name":"137.220.152.149","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '137.220.152.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2052541600086270051"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95281413-4a50-50c6-bb65-c67e183a814c","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--056411a5-8e7a-5794-be66-bede90b5a09e","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f613820-75e9-5f25-922b-d7159c4339c5","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b33de762-b37d-56c8-b007-fa246339152c","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f98e3f7-c98f-5456-b7e8-3a148723b54d","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5f3d36d-a0f3-5cd7-acde-851d874b65e3","created":"2026-05-08T00:56:00.000Z","modified":"2026-05-08T00:56:00.000Z","valid_from":"2026-05-08T00:56:00.000Z","name":"http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553275908690198"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd1bb8e1-59b9-5e2d-9cc0-f2ed402e501c","created":"2026-05-08T00:57:00.000Z","modified":"2026-05-08T00:57:00.000Z","valid_from":"2026-05-08T00:57:00.000Z","name":"mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553475968708682"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e9ebff1-a571-5c56-a4d1-7fb4dd23dd65","created":"2026-05-08T00:57:00.000Z","modified":"2026-05-08T00:57:00.000Z","valid_from":"2026-05-08T00:57:00.000Z","name":"http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052553475968708682"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f462d5c5-c6db-5553-adae-7b8af155eb64","created":"2026-05-08T00:58:00.000Z","modified":"2026-05-08T00:58:00.000Z","valid_from":"2026-05-08T00:58:00.000Z","name":"http://104.245.245.50:5000","description":"IOC reported by @johnk3r on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://104.245.245.50:5000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/johnk3r/status/2052553712803959225"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b341635-c2f6-5d93-b777-1bf207f46564","created":"2026-05-08T00:58:00.000Z","modified":"2026-05-08T00:58:00.000Z","valid_from":"2026-05-08T00:58:00.000Z","name":"104.245.245.50","description":"IOC reported by @johnk3r on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.245.245.50']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/johnk3r/status/2052553712803959225"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa5c6a10-1326-5f01-b8a1-876fffcbe66b","created":"2026-05-08T01:40:00.000Z","modified":"2026-05-08T01:40:00.000Z","valid_from":"2026-05-08T01:40:00.000Z","name":"5a1c14335d0a8b007ff2813e6ef738e8836be38257cc82fe03c02b71d71e1b01","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5a1c14335d0a8b007ff2813e6ef738e8836be38257cc82fe03c02b71d71e1b01']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2012236014253662296"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b651fc-71ac-52da-8859-8c6a00170fd4","created":"2026-05-08T02:00:00.000Z","modified":"2026-05-08T02:00:00.000Z","valid_from":"2026-05-08T02:00:00.000Z","name":"wweebbbddeee.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wweebbbddeee.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052569206852301013"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dd85f73-6542-5cdc-b772-018a677cf4c8","created":"2026-05-08T02:00:00.000Z","modified":"2026-05-08T02:00:00.000Z","valid_from":"2026-05-08T02:00:00.000Z","name":"https://wweebbbddeee.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wweebbbddeee.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052569206852301013"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--301d94d0-1bba-5f64-a11c-14896f789222","created":"2026-05-08T03:52:00.000Z","modified":"2026-05-08T03:52:00.000Z","valid_from":"2026-05-08T03:52:00.000Z","name":"horizonteconsult.com.br","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'horizonteconsult.com.br']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052597598436126731"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84b87a69-86d8-5d9a-a696-85ba5b48146c","created":"2026-05-08T03:52:00.000Z","modified":"2026-05-08T03:52:00.000Z","valid_from":"2026-05-08T03:52:00.000Z","name":"http://horizonteconsult.com.br/adobe/download.html","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://horizonteconsult.com.br/adobe/download.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052597598436126731"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94a898d5-4a72-5377-9d01-2d8f2730def4","created":"2026-05-08T03:52:00.000Z","modified":"2026-05-08T03:52:00.000Z","valid_from":"2026-05-08T03:52:00.000Z","name":"http://horizonteconsult.com.br/adobe/complete.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://horizonteconsult.com.br/adobe/complete.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052597598436126731"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f25dd1a8-4c35-5277-8936-0320775f9244","created":"2026-05-08T03:52:00.000Z","modified":"2026-05-08T03:52:00.000Z","valid_from":"2026-05-08T03:52:00.000Z","name":"https://horizonteconsult.com.br/adobe/download.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://horizonteconsult.com.br/adobe/download.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052597598436126731"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2a97c71-2ad5-507f-8de2-b021d2f4c94d","created":"2026-05-08T03:52:00.000Z","modified":"2026-05-08T03:52:00.000Z","valid_from":"2026-05-08T03:52:00.000Z","name":"1706da372629c3e4e840eedd50ee85480105d9bd615c42119ad2638b1751b432","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '1706da372629c3e4e840eedd50ee85480105d9bd615c42119ad2638b1751b432']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052597598436126731"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95780ad6-a7bf-572c-b69a-1bf261b7a4f8","created":"2026-05-08T04:00:00.000Z","modified":"2026-05-08T04:00:00.000Z","valid_from":"2026-05-08T04:00:00.000Z","name":"app.qpointsurvey.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'app.qpointsurvey.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052599428700115372"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28fd0831-c5ec-5b4b-b12f-ff1234143e27","created":"2026-05-08T04:00:00.000Z","modified":"2026-05-08T04:00:00.000Z","valid_from":"2026-05-08T04:00:00.000Z","name":"http://app.qpointsurvey.com/s/vjmotsuhuve7al3c","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://app.qpointsurvey.com/s/vjmotsuhuve7al3c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052599428700115372"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c13e2770-cf00-5762-bed8-227539172288","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"fontem.org","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fontem.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4cebf4-bf49-5383-8124-3cc7565574ae","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/download.html","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/download.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baca8cfd-9867-53e2-bed0-e5a4716ad4f6","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/complete.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/complete.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c831ba2d-7b17-59eb-a2d1-74097d58c18d","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/download.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://fontem.org/wp-admin/Advisor_Share_Wealth_Management/download.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c23c078f-abf0-5f81-8304-a6b988f0815c","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"remote.wrightliggh.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'remote.wrightliggh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5749177-7dfe-5760-87e7-2a2cc531883e","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"http://remote.wrightliggh.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://remote.wrightliggh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--965d9cbf-6c4a-5d45-87bc-548b042b62b9","created":"2026-05-08T04:08:00.000Z","modified":"2026-05-08T04:08:00.000Z","valid_from":"2026-05-08T04:08:00.000Z","name":"c143e4e66d3d0de754da401c34f0039eab71860b0f5d2d6227b8021677de9c4d","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c143e4e66d3d0de754da401c34f0039eab71860b0f5d2d6227b8021677de9c4d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052601573352599901"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8fa8f5b-6a94-52e0-9ba1-6b314234507f","created":"2026-05-08T04:48:00.000Z","modified":"2026-05-08T04:48:00.000Z","valid_from":"2026-05-08T04:48:00.000Z","name":"nmohtdt.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmohtdt.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052611597923975190"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1ed60f8-f73d-5700-9928-537ec60edb1a","created":"2026-05-08T04:48:00.000Z","modified":"2026-05-08T04:48:00.000Z","valid_from":"2026-05-08T04:48:00.000Z","name":"https://nmohtdt.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nmohtdt.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052611597923975190"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d22055a4-01af-5652-94d7-de78d8f33ae7","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkd.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b7872b4-678d-5059-bece-778444c4d64d","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkd.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkd.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19278419-b7ab-5e49-b179-d9dbac19fbce","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkc.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7975b05e-2d86-5e06-8032-9110648de02f","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkc.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkc.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53469ff9-bc3b-5557-b5b7-bfe654061884","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnke.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnke.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c4b0742-9f1e-569a-b8df-a820533123f5","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnke.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnke.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1e26d74-5d58-5bea-91a5-a5507cfcb923","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnki.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnki.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d2f7b58-dba6-559c-af25-69e6262f64ab","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnki.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnki.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--81e1a7a7-1b4f-538a-ac43-25053e278d5d","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkj.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd1117b3-13ad-55d1-a663-00b550bb8da7","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkj.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkj.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e035bfc-7da4-56d6-ae9f-a58718995c6b","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkh.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--62d6d8bf-a571-5c8c-b075-08b1b5a05cfc","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkh.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkh.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--23c21d9a-97b1-5353-9a8e-6253c0ed920a","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkf.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c3ee2db-6d87-57cb-8559-3c4836fbe026","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkf.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkf.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c57282f-a4bf-5159-8584-b2333c7c9b66","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkg.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4c1b0e2-3bf5-592f-b162-03c01e7dd0ca","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkg.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkg.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--994eb8cd-3514-5108-8c8c-d87148a4784a","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnkb.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnkb.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--44c89e41-27df-5208-b7ed-831c4c61e682","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnkb.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnkb.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ae24bb6-d616-5eef-b81d-720590f3519b","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"ashikagb-bnnka.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashikagb-bnnka.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0226037-d760-5783-b226-89151c500fa2","created":"2026-05-08T05:14:00.000Z","modified":"2026-05-08T05:14:00.000Z","valid_from":"2026-05-08T05:14:00.000Z","name":"https://ashikagb-bnnka.com/pages/db/dbca0100/input/clientviews/CCT0080=0120","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ashikagb-bnnka.com/pages/db/dbca0100/input/clientviews/CCT0080=0120']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052618235368112422"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--983cc3a5-3e3e-559b-aaa6-5f7b4fa96708","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"jppost--japan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jppost--japan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccde2f50-9e3a-53b9-b387-88b663b9b8e5","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://jppost--japan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jppost--japan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d380c24-f217-5c02-a884-fff6efc220a0","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"japan--postjp.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'japan--postjp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a53bfb9-c0d5-56e5-9d2f-0f4fff0e3f09","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://japan--postjp.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://japan--postjp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6045563d-d973-54ce-80e2-36b5692a021e","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"post--japanpost.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'post--japanpost.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--735ae1ef-b3f3-5719-82c5-28a78f7a41b9","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://post--japanpost.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://post--japanpost.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--65b29417-db53-57e5-b3ec-d2466f0f4692","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"post--jppost.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'post--jppost.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--405f35e4-4010-5fb4-b253-9c396f8523d4","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://post--jppost.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://post--jppost.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7310162a-f986-5d1e-8127-1f17d677f0e6","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"japan--post.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'japan--post.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--76ee86ca-a77c-5356-9823-0299a291fdd7","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://japan--post.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://japan--post.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb65aa6a-1e91-56e1-ad8e-b06d39704eea","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"post--japan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'post--japan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca054ab8-7bd0-5d65-b1a9-e2b31505f2ff","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://post--japan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://post--japan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcec9562-e5b4-5ef0-8b63-2f6b3befe24d","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"jppost-postjapan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jppost-postjapan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d1969fd-a309-53b8-88ef-d919fb0c5100","created":"2026-05-08T05:21:00.000Z","modified":"2026-05-08T05:21:00.000Z","valid_from":"2026-05-08T05:21:00.000Z","name":"https://jppost-postjapan.com","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jppost-postjapan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052619864611954981"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7718846-9507-511f-a1f1-b42c0cbb8fce","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"31.56.209.77","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.56.209.77']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdaf8551-bdd5-5348-9074-c56bb44f5e4e","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"31.56.209.82","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.56.209.82']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9f658df-21db-5802-8be6-78a2e2d1d37f","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"31.57.184.187","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.57.184.187']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d57fd10-9441-5766-9b29-3b035dd1ebba","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"45.9.168.220","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.9.168.220']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27eb505d-5932-593a-aaba-dc7c4bc35a7c","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"45.74.19.149","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.74.19.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d7164c7-f034-5eb0-a0f4-99c118bb36e5","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"46.183.223.21","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '46.183.223.21']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d268a9-bf80-5454-827d-f62482f344bd","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"54.37.128.55","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '54.37.128.55']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--565599b4-6b38-5a99-84d5-2e1154332ef6","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"77.83.39.212","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '77.83.39.212']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df8651d3-d48a-5d3d-aa06-131e0156fc15","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"84.247.142.79","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '84.247.142.79']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40c94fe6-fefb-5428-a7b1-3b0296da3e79","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"104.168.5.25","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.168.5.25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7a091cc-6849-568a-8101-7ce76589a7b1","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"130.12.181.93","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.12.181.93']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae4f6e15-2a6f-5da5-afa2-3e2c12d4535b","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"146.70.244.90","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '146.70.244.90']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0390e0d3-e668-566c-a029-bdb00786e670","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"149.33.34.27","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '149.33.34.27']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99ec3f79-b4fd-586b-8a00-47bbac1cd73e","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"192.227.219.75","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '192.227.219.75']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052622420222091620"}],"labels":["RAT","Remcos"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e8dab93-fefe-566c-8adb-ed4f50f6b28b","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"ashrafreda.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ashrafreda.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bb0ee3d-2380-5713-923b-d59b241b29f5","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://ashrafreda.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ashrafreda.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f6f247-9436-5180-9f26-f3519ed2d019","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"atomicurl.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'atomicurl.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41f036a1-4bd5-53ea-8ba3-1cd4e4ae3168","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://atomicurl.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://atomicurl.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25e312c0-e641-5a53-98df-f1030260f873","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"voice0356.us","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'voice0356.us']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc90006-2f08-5cfa-adda-89d6cc04c0de","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://voice0356.us","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://voice0356.us']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47056586-b1db-5c67-9d15-77c7888af6b7","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"techformulagrayfellowshipinvestments.tvwpotalsources.vu","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'techformulagrayfellowshipinvestments.tvwpotalsources.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--944947e0-bfcf-5207-9321-fbd94e2d2dee","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://techformulagrayfellowshipinvestments.tvwpotalsources.vu","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://techformulagrayfellowshipinvestments.tvwpotalsources.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b7572d0-565c-5f69-bb1c-f8326d27f695","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"easywaytech.co.ke","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'easywaytech.co.ke']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3660602-48fb-5b24-86e9-9ff8d7a3ee37","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://easywaytech.co.ke","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://easywaytech.co.ke']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf553ac7-ac1a-5a20-abcb-42d8b4bed554","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"enthusiastic-secure-link-go.base44.app","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'enthusiastic-secure-link-go.base44.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e855409-1a66-5205-95d5-9d5079ade935","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://enthusiastic-secure-link-go.base44.app","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://enthusiastic-secure-link-go.base44.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4ea0ccd-8a61-5246-8800-de9e49b05243","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"freight-sync-link.base44.app","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'freight-sync-link.base44.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33fe31f1-5f38-5ad2-84aa-82086a73cc13","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://freight-sync-link.base44.app","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://freight-sync-link.base44.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fe14517-6ce7-5b29-b128-453230129a2a","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"login.yum.homes","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.yum.homes']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe9d3897-f754-5470-b10d-1d6048f25b7e","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://login.yum.homes","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.yum.homes']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e43f4ade-6b05-551f-b574-ab65c3964c12","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"office.cotiviti.top","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'office.cotiviti.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce782272-19f2-5467-bd6b-bd09f4777894","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://office.cotiviti.top","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://office.cotiviti.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c28daa8-392f-593b-90dc-b734c8bcd4ba","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"hticybernetics.com.sharepoint.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hticybernetics.com.sharepoint.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a21d5bd-38cf-5483-b883-b929f9b6fb3c","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://hticybernetics.com.sharepoint.com/s/finance/Eba1","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hticybernetics.com.sharepoint.com/s/finance/Eba1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20710469-4c90-5437-bb71-752bb65574cb","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"berenzweiglaw.com.sharepoint.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'berenzweiglaw.com.sharepoint.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43dc3149-f226-5554-95ba-c770f001d1bf","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://berenzweiglaw.com.sharepoint.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://berenzweiglaw.com.sharepoint.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1d04785-c4d4-57ce-a72d-3eff6bac35a9","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"serviceamericanreprographicscompany.golkppdmansachs.vu","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'serviceamericanreprographicscompany.golkppdmansachs.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21f0d63f-d531-5b92-b439-7dbb2d6b4d5d","created":"2026-05-08T05:31:00.000Z","modified":"2026-05-08T05:31:00.000Z","valid_from":"2026-05-08T05:31:00.000Z","name":"http://serviceamericanreprographicscompany.golkppdmansachs.vu","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://serviceamericanreprographicscompany.golkppdmansachs.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2052622300416196856"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cff08707-0e23-50bc-ae4d-f5a02577e1bf","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"mudggc.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mudggc.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca098074-4e46-5df7-9472-9db8956365de","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://mudggc.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mudggc.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--79d772f5-71c4-5f79-afed-a8ebd52edf11","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"bvfcac.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bvfcac.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--49e52738-9e28-571f-bb59-71a82b19ea2f","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://bvfcac.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bvfcac.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--01afa27e-1dcc-5ce7-bb07-e9b36a786b6f","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"nbzqxe.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nbzqxe.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b5d2350-cdfe-55c1-bee7-c693dcf59c34","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://nbzqxe.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nbzqxe.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--93217519-3c02-5966-a081-a7fe399f9a2f","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"qpfhi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qpfhi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1c25874-53e5-5682-8d0b-372e881721a1","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://qpfhi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qpfhi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--557b2c01-36b8-5bae-a108-be953d27d15d","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"kenkbr.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kenkbr.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b389314-85c5-55fe-8c83-4e7c60191ddd","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://kenkbr.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kenkbr.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea982343-577d-5f4c-ba61-b7efe09f803f","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"nezon.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nezon.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--11c06dd4-ae31-5d55-bc72-aa0029d074b3","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://nezon.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nezon.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b45c193-d5fb-5d47-b0b8-ebaba1b0dd4e","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"rfesoj.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rfesoj.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--682ea4b6-9535-511e-95ef-1fc001d265ed","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://rfesoj.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rfesoj.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5218d22-16b8-5bba-95cc-e5a9b469fb55","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"rdkifi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rdkifi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27c961eb-e518-58d1-b539-631072614cc7","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://rdkifi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rdkifi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9bf087e-9f4b-5c53-8cff-6f9ff6e6d545","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"teubzs.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'teubzs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c03a7886-81e3-55b7-a36c-15044b190d66","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://teubzs.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://teubzs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e14e15d-b6bc-5026-b628-c8402c861650","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"nakyl.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nakyl.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f56ef09-5825-567a-84e8-4bd8b7675ab7","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://nakyl.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nakyl.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d42b0759-cf2b-5a52-b192-876c63a5e105","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"rlzxvii.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rlzxvii.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dcbf6ae-e653-5074-9da0-6aa7f4cc7aba","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://rlzxvii.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rlzxvii.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9b85327-3e9c-5a4a-93a1-4188c21d9ba3","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"oabgfv.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'oabgfv.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--810d9bb3-a745-5e53-a1c3-53666c918521","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://oabgfv.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://oabgfv.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--428a7ba2-2586-5d48-a455-c957e8011056","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"jighkb.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jighkb.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--497c3299-58d4-5f84-aaf6-5c15e1a0acd1","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://jighkb.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jighkb.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f4c4036-a931-5a31-8ea1-bc2462da054a","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"lmlbjr.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lmlbjr.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--df037336-3e7a-5243-b9ee-0f6fad226e3a","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://lmlbjr.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://lmlbjr.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1413306b-7165-53fd-9564-6d800b3d421a","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"gkwssi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gkwssi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--47777a9d-aab1-5be1-92fb-e57d9048edae","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://gkwssi.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://gkwssi.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--89c02506-2dae-580e-a057-369feff3247a","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"aajrvt.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aajrvt.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b342b73-21f0-5265-a0b1-4a59854bd8c9","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://aajrvt.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://aajrvt.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e60dbcd-710a-50c1-a62c-7f03b83c4a74","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"iknsvx.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'iknsvx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6623368-30b6-5580-8a6c-435a2d314370","created":"2026-05-08T05:38:00.000Z","modified":"2026-05-08T05:38:00.000Z","valid_from":"2026-05-08T05:38:00.000Z","name":"https://iknsvx.cn","description":"IOC reported by @KesaGataMe0 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://iknsvx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/KesaGataMe0/status/2052624191409770784"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd214009-d622-5898-b940-10e469817b3c","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"8.210.238.216","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.210.238.216']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--04847e17-74c5-5b8e-96f6-1d8651a018e8","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"8.222.143.232","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.222.143.232']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8651c90-1196-5a55-a20b-8222678ff11c","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"23.226.57.45","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.226.57.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e472494-ac2d-5698-bd88-e0e9bcb9a5c2","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"43.229.114.154","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.229.114.154']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4b3707a-7904-5630-8349-009500b0ac12","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.76.195.75","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.76.195.75']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b3f0438-651c-5823-a51d-0e3490ec19a0","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.84.32.184","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.84.32.184']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dbab25f-ebd4-5d55-9393-40b934c0b443","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.84.203.113","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.84.203.113']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fac764d-3594-55d6-b504-a0751b2fb634","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.236.106.45","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.236.106.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d4b309-775d-5504-bcf4-558ff78a7b94","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.237.206.223","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.237.206.223']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d20b7c15-dd35-5e88-88d0-38f9db4657d5","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.250.88.61","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.250.88.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d65732fb-07a2-5d6f-8b4b-1b0b36ea6be6","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.250.140.98","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.250.140.98']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--44813c70-4b06-5229-a326-c3742d113017","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.254.195.155","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.254.195.155']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27df28cf-bd94-54ba-b762-0e8d0cc5c3ad","created":"2026-05-08T05:53:00.000Z","modified":"2026-05-08T05:53:00.000Z","valid_from":"2026-05-08T05:53:00.000Z","name":"47.254.213.50","description":"IOC reported by @K_N1kolenko on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '47.254.213.50']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/K_N1kolenko/status/2052627848687386797"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d7d3665-7f24-58ad-8d9f-925d81482b9a","created":"2026-05-08T06:01:00.000Z","modified":"2026-05-08T06:01:00.000Z","valid_from":"2026-05-08T06:01:00.000Z","name":"tecote.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tecote.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052630049288016269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64d80aab-fcb6-55fc-852d-f8e9d9b1a382","created":"2026-05-08T06:01:00.000Z","modified":"2026-05-08T06:01:00.000Z","valid_from":"2026-05-08T06:01:00.000Z","name":"https://www.tecote.com/liopa_home/","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.tecote.com/liopa_home/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052630049288016269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9420a90-e412-5f12-873a-02e70eac81e6","created":"2026-05-08T06:01:00.000Z","modified":"2026-05-08T06:01:00.000Z","valid_from":"2026-05-08T06:01:00.000Z","name":"https://www.tecote.com/liopa_home/download.html","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.tecote.com/liopa_home/download.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052630049288016269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93a4f36f-83fa-5188-927a-886ddc1c932f","created":"2026-05-08T06:01:00.000Z","modified":"2026-05-08T06:01:00.000Z","valid_from":"2026-05-08T06:01:00.000Z","name":"https://www.tecote.com/liopa_home/download.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.tecote.com/liopa_home/download.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052630049288016269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee710b8e-20dc-5e08-96ba-724e55eab5cd","created":"2026-05-08T06:01:00.000Z","modified":"2026-05-08T06:01:00.000Z","valid_from":"2026-05-08T06:01:00.000Z","name":"298f59d1f3b905563e7c5830911b11607583c0cad4a539ac4c6bdbfe4a1356c6","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '298f59d1f3b905563e7c5830911b11607583c0cad4a539ac4c6bdbfe4a1356c6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2052630049288016269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b3d37ae-7e87-5e44-9ae0-46aa2b3910b4","created":"2026-05-08T06:25:00.000Z","modified":"2026-05-08T06:25:00.000Z","valid_from":"2026-05-08T06:25:00.000Z","name":"donarimadafo.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'donarimadafo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2052636000921477346"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7a82cf-e891-5db7-9d61-7e345b1cbbb8","created":"2026-05-08T06:25:00.000Z","modified":"2026-05-08T06:25:00.000Z","valid_from":"2026-05-08T06:25:00.000Z","name":"http://donarimadafo.com/spg/login.php","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://donarimadafo.com/spg/login.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2052636000921477346"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ec93172-b2a7-5f47-b94c-116ed28ecbe8","created":"2026-05-08T07:13:00.000Z","modified":"2026-05-08T07:13:00.000Z","valid_from":"2026-05-08T07:13:00.000Z","name":"cyiqzkk.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cyiqzkk.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052647982995276056"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--888c6a23-79ba-5601-ae07-78ba82e9922b","created":"2026-05-08T07:13:00.000Z","modified":"2026-05-08T07:13:00.000Z","valid_from":"2026-05-08T07:13:00.000Z","name":"https://cyiqzkk.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cyiqzkk.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052647982995276056"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db59b7bf-1297-5923-bc6a-1f4775dd406a","created":"2026-05-08T08:00:00.000Z","modified":"2026-05-08T08:00:00.000Z","valid_from":"2026-05-08T08:00:00.000Z","name":"junoxfiinc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'junoxfiinc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052659831832457442"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffbc0e2f-361f-55e8-9310-f2e4603b930a","created":"2026-05-08T08:00:00.000Z","modified":"2026-05-08T08:00:00.000Z","valid_from":"2026-05-08T08:00:00.000Z","name":"https://junoxfiinc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://junoxfiinc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052659831832457442"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ae648aa-b0b4-527e-9b95-29afb571db7b","created":"2026-05-08T09:35:00.000Z","modified":"2026-05-08T09:35:00.000Z","valid_from":"2026-05-08T09:35:00.000Z","name":"oasis-aviation-named-pike.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'oasis-aviation-named-pike.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052683774232498240"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d2e105d-bf50-5aeb-b716-34f9333d104f","created":"2026-05-08T09:35:00.000Z","modified":"2026-05-08T09:35:00.000Z","valid_from":"2026-05-08T09:35:00.000Z","name":"https://oasis-aviation-named-pike.trycloudflare.com/hen/","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://oasis-aviation-named-pike.trycloudflare.com/hen/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052683774232498240"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edde390a-ba22-5a43-a695-012869bfdaa6","created":"2026-05-08T09:39:00.000Z","modified":"2026-05-08T09:39:00.000Z","valid_from":"2026-05-08T09:39:00.000Z","name":"12.5.0.242","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '12.5.0.242']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2052684683926802800"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f75ea8e-6805-5f50-81ad-904e3cabc5c8","created":"2026-05-08T10:00:00.000Z","modified":"2026-05-08T10:00:00.000Z","valid_from":"2026-05-08T10:00:00.000Z","name":"sudrex.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sudrex.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052690031010086951"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--738a0fce-8583-5630-823e-4bb3576284ff","created":"2026-05-08T10:00:00.000Z","modified":"2026-05-08T10:00:00.000Z","valid_from":"2026-05-08T10:00:00.000Z","name":"https://sudrex.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sudrex.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052690031010086951"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6995764f-1c48-5696-a5e5-efd482f26e0d","created":"2026-05-08T10:08:00.000Z","modified":"2026-05-08T10:08:00.000Z","valid_from":"2026-05-08T10:08:00.000Z","name":"cas-blocks-disciplinary-practice.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cas-blocks-disciplinary-practice.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052692036340400446"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--544b1837-c901-5e5b-9955-ecd146801959","created":"2026-05-08T10:08:00.000Z","modified":"2026-05-08T10:08:00.000Z","valid_from":"2026-05-08T10:08:00.000Z","name":"https://cas-blocks-disciplinary-practice.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cas-blocks-disciplinary-practice.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052692036340400446"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab93b1f-49bf-59e4-8999-f580df082bca","created":"2026-05-08T10:13:00.000Z","modified":"2026-05-08T10:13:00.000Z","valid_from":"2026-05-08T10:13:00.000Z","name":"w1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'w1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052693305176015087"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d71f0428-00b9-5764-8924-4b0433e11bf6","created":"2026-05-08T10:13:00.000Z","modified":"2026-05-08T10:13:00.000Z","valid_from":"2026-05-08T10:13:00.000Z","name":"http://w1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://w1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052693305176015087"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a931e14-2c3d-5fe6-9f62-ce947c215942","created":"2026-05-08T10:13:00.000Z","modified":"2026-05-08T10:13:00.000Z","valid_from":"2026-05-08T10:13:00.000Z","name":"a78188a50f25e9b28f52c297dc4137c81f8da60d1a1422735378f1416a36bc92","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a78188a50f25e9b28f52c297dc4137c81f8da60d1a1422735378f1416a36bc92']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052693305176015087"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf664d1-b5b3-5cb0-a3e9-6a8dfbe424fb","created":"2026-05-08T10:16:00.000Z","modified":"2026-05-08T10:16:00.000Z","valid_from":"2026-05-08T10:16:00.000Z","name":"http://104.194.154.116","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://104.194.154.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052694060696019193"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--053c84a9-ef6a-5e2d-a9e6-6fc80474c010","created":"2026-05-08T10:16:00.000Z","modified":"2026-05-08T10:16:00.000Z","valid_from":"2026-05-08T10:16:00.000Z","name":"104.194.154.116","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.194.154.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052694060696019193"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5c5765a-ed82-57bf-908a-01e1bd237294","created":"2026-05-08T10:19:00.000Z","modified":"2026-05-08T10:19:00.000Z","valid_from":"2026-05-08T10:19:00.000Z","name":"d75edc42b3c9f2af7dee42ec38a12ae12a43983b7012afee4f8a1959e1d6d8a9","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd75edc42b3c9f2af7dee42ec38a12ae12a43983b7012afee4f8a1959e1d6d8a9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052694940002451578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b60fe3a-1cd8-55e1-a0d5-8fb7bee10f74","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"endlessai.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'endlessai.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a02d672-1a33-5801-bd7d-85c43df6cd1b","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://endlessai.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://endlessai.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--313f4c85-f86d-5f41-b764-f0065b90dc49","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"socolive.studio","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'socolive.studio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--816b1d7f-19a5-5c72-859d-707dbd3b6269","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://socolive.studio","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://socolive.studio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088bb71e-09b3-51b9-9fe7-32ee6e1fc9b5","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"novatoken.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'novatoken.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c92f3dc7-82e3-53b3-b0a5-46027ae8df53","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://novatoken.io","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://novatoken.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e89e78c-00fa-5861-bf36-f87142f5a9e1","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"xoilac-3.com","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xoilac-3.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3867075d-0e1d-5e2c-b22b-9eec3830b280","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://xoilac-3.com","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xoilac-3.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01eaa63f-404a-53ea-b4a7-ab55487bea9b","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"techieankit.in","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'techieankit.in']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e11aea2-cfe6-5541-8981-ba8d0762ba48","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://techieankit.in","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://techieankit.in']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d07cf36-db45-54d6-a669-54f4c3eadca0","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"cakhia03.tv","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cakhia03.tv']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7f31984-8b6c-5caa-87e1-1660a13d4cec","created":"2026-05-08T10:34:00.000Z","modified":"2026-05-08T10:34:00.000Z","valid_from":"2026-05-08T10:34:00.000Z","name":"http://cakhia03.tv","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cakhia03.tv']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2052698678977061065"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce0007de-d91f-5573-8c4d-08cff426aff4","created":"2026-05-08T10:43:00.000Z","modified":"2026-05-08T10:43:00.000Z","valid_from":"2026-05-08T10:43:00.000Z","name":"ef5b753e5a2118d18c5e809c3d159a35","description":"IOC reported by @askardyuss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'ef5b753e5a2118d18c5e809c3d159a35']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/askardyuss/status/2052700974301827268"}],"labels":["MustangPanda"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c35888ed-bf2b-5bbc-9668-df6872c587e6","created":"2026-05-08T11:56:00.000Z","modified":"2026-05-08T11:56:00.000Z","valid_from":"2026-05-08T11:56:00.000Z","name":"votelit.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'votelit.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052719394338353331"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63c18a0c-79e1-54d2-9aff-af2e1742256e","created":"2026-05-08T11:56:00.000Z","modified":"2026-05-08T11:56:00.000Z","valid_from":"2026-05-08T11:56:00.000Z","name":"http://votelit.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://votelit.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052719394338353331"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19b4de7e-3413-55dd-b54d-99f45d988489","created":"2026-05-08T12:00:00.000Z","modified":"2026-05-08T12:00:00.000Z","valid_from":"2026-05-08T12:00:00.000Z","name":"meenuparashar18.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'meenuparashar18.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052720224588169431"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fd10e8a-1e69-589e-8efc-c299457b9a20","created":"2026-05-08T12:00:00.000Z","modified":"2026-05-08T12:00:00.000Z","valid_from":"2026-05-08T12:00:00.000Z","name":"http://meenuparashar18.github.io/Netflix-clone","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://meenuparashar18.github.io/Netflix-clone']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052720224588169431"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c4b9c27-fc5b-5423-9d70-885dfeb78c19","created":"2026-05-08T12:06:00.000Z","modified":"2026-05-08T12:06:00.000Z","valid_from":"2026-05-08T12:06:00.000Z","name":"vote.p4rt.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vote.p4rt.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052721820965413167"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31ce97a-dcf7-543d-a73a-2b5e8afe797b","created":"2026-05-08T12:06:00.000Z","modified":"2026-05-08T12:06:00.000Z","valid_from":"2026-05-08T12:06:00.000Z","name":"http://vote.p4rt.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://vote.p4rt.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052721820965413167"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea642a4c-79e6-51f6-893a-dbd8138eae7a","created":"2026-05-08T12:21:00.000Z","modified":"2026-05-08T12:21:00.000Z","valid_from":"2026-05-08T12:21:00.000Z","name":"precommit.vercel.app","description":"IOC reported by @blackorbird on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'precommit.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/blackorbird/status/2052725668077867070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1a259dc-a2e7-5541-9ac8-5ba1ca66a2c5","created":"2026-05-08T12:21:00.000Z","modified":"2026-05-08T12:21:00.000Z","valid_from":"2026-05-08T12:21:00.000Z","name":"http://precommit.vercel.app","description":"IOC reported by @blackorbird on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://precommit.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/blackorbird/status/2052725668077867070"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b38ac8bb-91f7-5882-a1d4-e63151ec5a11","created":"2026-05-08T12:38:00.000Z","modified":"2026-05-08T12:38:00.000Z","valid_from":"2026-05-08T12:38:00.000Z","name":"5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3","description":"IOC reported by @rifteyy on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5a6636ce490789d7f26aaa86e50bd65c7330f8e6a7c32418740c1d009fb12ef3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/rifteyy/status/2052729741426250110"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3f2a494-8191-55d7-88ac-c8ff7a0fbf0e","created":"2026-05-08T12:38:00.000Z","modified":"2026-05-08T12:38:00.000Z","valid_from":"2026-05-08T12:38:00.000Z","name":"77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80","description":"IOC reported by @rifteyy on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '77a60b5c443f011dc67ace877f5b2ad7773501f3d82481db7f4a5238cf895f80']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/rifteyy/status/2052729741426250110"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed29ce48-acc8-5cf1-a9ee-d71edbede7b8","created":"2026-05-08T12:38:00.000Z","modified":"2026-05-08T12:38:00.000Z","valid_from":"2026-05-08T12:38:00.000Z","name":"5fdbee7aa7ba6a5026855a35a9fe075967341017d3cb932e736a12dd00ed590a","description":"IOC reported by @rifteyy on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5fdbee7aa7ba6a5026855a35a9fe075967341017d3cb932e736a12dd00ed590a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/rifteyy/status/2052729741426250110"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b488fc4-04e1-5408-91b8-3ae1068001fa","created":"2026-05-08T13:01:00.000Z","modified":"2026-05-08T13:01:00.000Z","valid_from":"2026-05-08T13:01:00.000Z","name":"U9x1.one.bss0017.modemeld.biz.ua","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'U9x1.one.bss0017.modemeld.biz.ua']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2052735700760486150"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c3b72b1-7e15-5c89-8c8c-9ad8941106b4","created":"2026-05-08T13:01:00.000Z","modified":"2026-05-08T13:01:00.000Z","valid_from":"2026-05-08T13:01:00.000Z","name":"http://U9x1.one.bss0017.modemeld.biz.ua","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://U9x1.one.bss0017.modemeld.biz.ua']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2052735700760486150"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e8f5979-359f-5b0a-b25f-713d6e10264d","created":"2026-05-08T13:42:00.000Z","modified":"2026-05-08T13:42:00.000Z","valid_from":"2026-05-08T13:42:00.000Z","name":"https://80.211.196.157:7443/new/login","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://80.211.196.157:7443/new/login']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2052745893695414565"}],"labels":["C2","Mythic"]},{"type":"indicator","spec_version":"2.1","id":"indicator--030bdaf1-01e8-58d3-b170-9d17da050979","created":"2026-05-08T13:42:00.000Z","modified":"2026-05-08T13:42:00.000Z","valid_from":"2026-05-08T13:42:00.000Z","name":"healthy.zubhium.com:7443","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'healthy.zubhium.com:7443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2052745893695414565"}],"labels":["C2","Mythic"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a10d184-f547-5268-aa0c-32823d10dda4","created":"2026-05-08T13:42:00.000Z","modified":"2026-05-08T13:42:00.000Z","valid_from":"2026-05-08T13:42:00.000Z","name":"https://healthy.zubhium.com:7443","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://healthy.zubhium.com:7443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2052745893695414565"}],"labels":["C2","Mythic"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6a32f68-5da6-5ee2-b619-50c7362344fd","created":"2026-05-08T13:42:00.000Z","modified":"2026-05-08T13:42:00.000Z","valid_from":"2026-05-08T13:42:00.000Z","name":"80.211.196.157","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '80.211.196.157']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2052745893695414565"}],"labels":["C2","Mythic"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a32a5ec0-54e0-5ace-8f36-e6fb0c862bba","created":"2026-05-08T14:00:00.000Z","modified":"2026-05-08T14:00:00.000Z","valid_from":"2026-05-08T14:00:00.000Z","name":"priyadarshii786.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'priyadarshii786.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052750418002722924"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd8441a5-cbf9-590b-ad9b-ce1b11a645ec","created":"2026-05-08T14:00:00.000Z","modified":"2026-05-08T14:00:00.000Z","valid_from":"2026-05-08T14:00:00.000Z","name":"http://priyadarshii786.github.io/Netflix_Clone","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://priyadarshii786.github.io/Netflix_Clone']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052750418002722924"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3be6c019-e69d-523e-9a6b-9d819b1fdda1","created":"2026-05-08T14:45:00.000Z","modified":"2026-05-08T14:45:00.000Z","valid_from":"2026-05-08T14:45:00.000Z","name":"http://103.79.79.21:8899/login","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://103.79.79.21:8899/login']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2039439398383583584"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0fa54b-6d69-5b28-a493-12533f7100a6","created":"2026-05-08T14:45:00.000Z","modified":"2026-05-08T14:45:00.000Z","valid_from":"2026-05-08T14:45:00.000Z","name":"103.79.79.21","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.79.79.21']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2039439398383583584"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--80f4ad9b-e368-5489-86e5-24114d7be7c1","created":"2026-05-08T14:50:00.000Z","modified":"2026-05-08T14:50:00.000Z","valid_from":"2026-05-08T14:50:00.000Z","name":"5b5a306e93a17a7edba89301717e304f72134cc5bfd900c4bf8fc2ea617fabdf","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5b5a306e93a17a7edba89301717e304f72134cc5bfd900c4bf8fc2ea617fabdf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2052763006900256851"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--782cff8d-942d-517a-a7b5-8171adf9f654","created":"2026-05-08T14:53:00.000Z","modified":"2026-05-08T14:53:00.000Z","valid_from":"2026-05-08T14:53:00.000Z","name":"meetings.bloombergpartner.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'meetings.bloombergpartner.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052763814731321431"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e4b324b-a936-50c5-afd6-dfc09ad02313","created":"2026-05-08T14:53:00.000Z","modified":"2026-05-08T14:53:00.000Z","valid_from":"2026-05-08T14:53:00.000Z","name":"http://meetings.bloombergpartner.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://meetings.bloombergpartner.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052763814731321431"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25d909ad-4851-58e9-b69a-ad806a1d5090","created":"2026-05-08T14:54:00.000Z","modified":"2026-05-08T14:54:00.000Z","valid_from":"2026-05-08T14:54:00.000Z","name":"bmoolberg.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bmoolberg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052764095904944172"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f724e120-cc65-5e2e-b076-ab6c6b2fd15c","created":"2026-05-08T14:54:00.000Z","modified":"2026-05-08T14:54:00.000Z","valid_from":"2026-05-08T14:54:00.000Z","name":"http://bmoolberg.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bmoolberg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052764095904944172"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7774cc49-b9c0-555d-b1fb-2a992272e32e","created":"2026-05-08T14:57:00.000Z","modified":"2026-05-08T14:57:00.000Z","valid_from":"2026-05-08T14:57:00.000Z","name":"f09e7fb98cdc27234d9c76e524aaa0348e86a7bc7013f1ba57e5ea068dcd9689","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f09e7fb98cdc27234d9c76e524aaa0348e86a7bc7013f1ba57e5ea068dcd9689']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052764950599213510"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd28fcea-a82a-5566-85ec-ce48f32d9d43","created":"2026-05-08T15:01:00.000Z","modified":"2026-05-08T15:01:00.000Z","valid_from":"2026-05-08T15:01:00.000Z","name":"073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '073eb2fb4cb1cdbc14c435028dfd04ca631dac4d713b1bfce573f84e90757d37']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052765746103504903"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f398e004-9008-559f-b87a-0a3bc02643ea","created":"2026-05-08T16:00:00.000Z","modified":"2026-05-08T16:00:00.000Z","valid_from":"2026-05-08T16:00:00.000Z","name":"zimbraagencialogisticagovco.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zimbraagencialogisticagovco.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052780611194982717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--447bea7f-879d-5ab2-9ea1-ca794c493ef9","created":"2026-05-08T16:00:00.000Z","modified":"2026-05-08T16:00:00.000Z","valid_from":"2026-05-08T16:00:00.000Z","name":"https://zimbraagencialogisticagovco.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zimbraagencialogisticagovco.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052780611194982717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--412dffbc-eb99-55a4-9ad2-e86144450467","created":"2026-05-08T18:00:00.000Z","modified":"2026-05-08T18:00:00.000Z","valid_from":"2026-05-08T18:00:00.000Z","name":"nid-naverpep.servequake.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-naverpep.servequake.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2052810787010543708"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8b36958-6b06-5a03-b692-ba7f92908361","created":"2026-05-08T18:00:00.000Z","modified":"2026-05-08T18:00:00.000Z","valid_from":"2026-05-08T18:00:00.000Z","name":"http://nid-naverpep.servequake.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-naverpep.servequake.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2052810787010543708"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-08T18:00:00.000Z","modified":"2026-05-08T18:00:00.000Z","valid_from":"2026-05-08T18:00:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2052810787010543708"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-08T18:00:00.000Z","modified":"2026-05-08T18:00:00.000Z","valid_from":"2026-05-08T18:00:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2052810787010543708"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec7fbc49-2a19-5707-a01a-91e3cb83104a","created":"2026-05-08T18:09:00.000Z","modified":"2026-05-08T18:09:00.000Z","valid_from":"2026-05-08T18:09:00.000Z","name":"e9df9fe7c5f9185c420974b6c31025d5","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'e9df9fe7c5f9185c420974b6c31025d5']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2052813069685031172"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fe266c5-c280-57cc-b998-0e26b4cf4751","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2dd8db1-d1ab-5ce7-8f1b-2f640facb038","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a5b9fc5-8982-5383-8093-6758c7710796","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8acb7914-60c2-5b28-842a-b1606c761b86","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0d91b15-9a35-59c4-b460-045c57d2d3d2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eab58e7a-78ac-5265-9420-e252a83bc12d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e67017d-503f-5f90-b0b3-5a0cbf6ff4d5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecea73e9-5bd9-5bab-b679-45e6b16588ae","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78b6d289-a9ea-527f-9a88-7f3c1418f790","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--120a17a6-0fa8-5b02-8560-db0d8420caa0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5571b117-694c-5743-8f67-7bf775a413df","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--223cbab6-bea0-512f-af65-ab37d26d6cf1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9380bc93-e00b-51e4-a8b2-bae6d2cccb28","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fd4703f-1fdc-5241-b45d-23094e928531","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23367932-8a4c-5624-b693-dc9c3d3ddcc7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf4efaac-3764-5c68-be17-1cfd39ebdf38","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8c036bf-2e33-5431-abf6-001aaa5be6a1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gosi66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gosi66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4555803c-ab48-5567-9dbf-7fde0bc96fad","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gosi66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gosi66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d351cf48-a254-506f-b948-8fe83ad50fd9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e040291f-d3a1-5825-a6ab-511be723bb7e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e8a0acf-f02e-5041-b082-2c6a449332bd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68d169c7-0b90-5b3d-b8e0-355d16c043d8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb3b212c-e5b1-574d-bb42-6c0bc7be28fb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8da0e58-b357-5c8e-821d-ce1e86f1cf99","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba326831-9b2c-5e63-96ea-1b1daffe018e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bdf2283-710e-5f19-9aa8-2218ec3efc38","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3e91bb4-f803-537e-a0d8-0126a30e1d9b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--251ec944-fc6e-56e1-ac97-ef49ad643ff7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e475ff67-386f-549e-8b66-0d811af9e1d5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2867c764-cdf0-5a3f-a3b3-aca1347f5fc5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9aee5c8a-b5bb-537b-8dc2-b5c217fef3c5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f98ffc3-d63c-54d7-b3bf-837b6a2fd5c6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71b03c44-eef9-59ed-9285-bc75e5a4634e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1fdafc7-ac8d-5048-bae7-337625be0777","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de29c4c3-1371-5e9e-8bb8-30c728d3b42a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gozi51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gozi51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--578357ce-40e4-555b-9855-b67d6306094f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gozi51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gozi51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17309bcd-1112-5e4c-953a-b0262da2706f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8318cf2e-a68b-5d34-be8e-2f29acabf93c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b7f2855-34c0-517b-8340-c75e8c017d88","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"now72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'now72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f1336b7-0f42-547c-b6a7-3e062bfd7535","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://now72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://now72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30f1bf19-428a-513e-b736-74321e3aac64","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f0e941a-ba0a-538a-8052-3a6b356c3013","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ec0d81a-d900-5a30-93a8-8a417c13ae05","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"now14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'now14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d4bfe58-2de9-5528-ac8c-450aef4f397a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://now14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://now14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2ef314f-9a7d-5332-b94d-ce4cc60d112c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"node39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5cc7599e-db76-5510-af9b-cf8143f02344","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://node39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b94636b7-177b-5483-9b8f-e9a35e44bd7d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92651e75-321b-541d-8286-5f2aa3e905b5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e61a343b-b882-5cac-bbee-a684851a48ef","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57c5d6c4-30b8-5024-8c02-f6fb0c1d4ece","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb42d3df-f2fe-5cf6-9e8a-4181d2494ad6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0660da30-9c2a-523d-8e03-d5f14ff5b437","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e0fb649-c029-5d2e-8cd2-c813b754bf87","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4bf469d-b74b-5f85-a93f-00ec0d8ad9c0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0094e950-d260-595b-876c-08a7b0a063b3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"pill47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pill47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b42eab3-e533-53ea-82c8-24cdef4763d4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://pill47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pill47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1965245-1676-5659-9053-2513fc7cc04d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0665c022-6729-537b-b823-22466f4b9038","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a95c6516-ad91-5d6c-9af5-fca1516ff195","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said0s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said0s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb390203-ce38-5772-9481-1635b40940af","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said0s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said0s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffab592c-5181-575e-acf4-5cc9542c47aa","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a67b3e-b8d6-5276-8c0e-7bc309fbcc35","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8043755-44dd-5f99-9dd6-afaf02bf6837","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a0d7b14-5fb3-5edf-b201-5bf6860b3421","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b05b22b6-7c0e-5ea7-bd84-b3371619c65b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"pill26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pill26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da7f15ae-f2ce-5f56-af4e-9a01dcf1cddb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://pill26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pill26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98c7ae79-4553-56eb-9897-d72e0c6eed5e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e639b97-6945-52f3-af6b-1242046ff9d1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2b24ec0-a44f-5ccb-ad21-e0b1703e95d3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"said18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'said18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4bb5496-7601-56c7-a7ea-3ded39d9dab8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://said18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://said18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a68f0fc-0597-551f-86de-bfb0529e852a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"now59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'now59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91d6a2c2-117b-54cb-9b82-35d51e7fa5ee","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://now59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://now59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93ffed48-6592-5e60-9d04-3f2738bacef8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"now50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'now50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34685a05-0f2e-5e96-9e1c-f33328ae7c75","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://now50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://now50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52fb5508-2b5a-58ed-be2c-1c8b8033a877","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de914135-abf0-59d3-b3f8-9a174e80ded9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ded3f9c-654f-5fcb-9165-3f56ef9fc03d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64578747-5d75-510e-bdc7-c06acad7c1cf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bee5e6ef-91ad-561a-aafb-779be23a507a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec5a90cb-76f4-57bb-bb72-2dd7e707b096","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c90089e-fa15-5254-819a-7fbc81f2886e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree37s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree37s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--316564ea-7070-5812-8fab-6dd722ebdd4d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree37s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree37s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9d135d7-a25a-5a9f-9b47-9785882868e6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38f24e16-faef-548e-b4b5-7e0285bd3f5d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4da8055-64a2-5d16-9117-a9a5ef7ee7a1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"gree25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gree25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4b75553-a38f-5750-b6fe-d361612fc44b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://gree25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gree25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1d9e347-c125-5103-a606-73e45cbd63f8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae931b16-6596-5874-9c7f-c5c8f4a1b61c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a90f5d7f-be61-5638-aaa5-0e5a39883d4b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a19c0c5f-c822-5d8f-8ec9-20c2b58ea841","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35cbde6f-a807-5a67-ad71-08a981042ca4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6730c8c-e214-5d91-a204-17c7f9baffb1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03fdfe38-9362-5177-b52e-fb50428d0c98","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c27a7cf-2039-5fe1-af79-8b14f14453f3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368b54ab-611c-5b2a-94aa-54d3ab91a777","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df40af22-e65a-527c-9fc8-0ad8e409e62e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ede8c6ef-32b5-5cd0-a1ae-56be34216004","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--365bdc07-6139-5167-8c0c-00c88efc872a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4a6950c-2167-5801-8821-1b6c5947f0cb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5626df2e-a74e-5ff0-aec2-79bbbd64e06c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6efb9c8-15ec-585c-b2cd-306529bb580d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read98s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read98s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--406dff42-f3a3-51e9-9ebc-fb6027061576","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read98s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read98s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bc7b7a6-c0af-59b9-a477-f3e89c35cf7b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd1ba016-f6ee-58db-b84f-ef791df70e09","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8a9cfe7-2481-5add-b05d-05e25f9dd176","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b3cbd9-f081-5ee9-acc6-81dbe26cdd01","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--089bf658-f273-5193-ab99-363750d123f1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6c56692-68eb-52a6-9a2a-5f07bed17596","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8b1c656-4420-5f1e-8293-a03690913cc8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10a0f286-334e-5e4d-b83e-5008bc93cde7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a510dc30-26bf-53a5-ba1e-20d5bf2726ac","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18721cfb-c88a-5912-86f7-a5009144a9af","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9385d297-84bc-535a-b9fa-025a8650d62b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read91s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read91s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14bea8ec-e825-58bb-84e0-61cb7b79a834","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read91s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read91s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5f0022c-f98b-5bf4-8b5f-0f42594ea40c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6495de7-f5b8-5a0d-801f-ca598eb2ca9c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e95c6c5-c872-5625-bb38-9cb42705a79d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31cd9fa-6cb9-52bd-b56f-6bfa50aa208e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94e96ebe-150d-5d8c-9516-a513881ea537","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfa5f988-d184-5579-b812-10e6120044ed","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8ce8db-0506-5a46-947e-cf74467df7ea","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e9a0bdd-026f-5c99-9260-fee26dcb7098","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d5a4a21-37c4-5175-94e8-a5316ea2172a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33176f61-5137-579d-a18a-e8f8a156e566","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7acf7a7e-56c0-5682-94b5-b94caaf674bb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8630aa8d-f9f4-515f-b442-790629e79769","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21ee17f4-662b-5a0f-8089-6bdf5019ea3e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daceedeb-0f20-5312-a790-5336c52cfecc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2863690a-8abf-5f37-a594-4b167fbdc371","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5273be-c1c6-52ab-a0b9-59ddc999670e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9c88eef-171f-52a0-bea5-fc9405e5bd5a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01036fe5-f1d6-5151-9d3e-58d2a83c9c24","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0461bb5b-7b5e-5737-ad83-2360fa2baecc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b2847ca-e81c-50ee-8cda-1bd21a61347c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e3a356a-b587-5633-894c-c924af8e6575","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f96e395c-ed8b-5699-a3b4-f14bfd4d5607","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14206ad8-db08-57e0-9c88-a9afa68d996e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c68047e-143d-5c61-8eb8-d3f63d3ad14d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74aa0486-6514-5a8e-9826-68152f314a2b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cbb23a4-6f2b-5948-b523-6dc0b114fb12","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aee9118e-a989-596c-a561-10c5cb453a59","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b4e5f77-97e8-53d1-beee-735a8a50b7f8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc84bcd3-5383-5a86-85b0-229b4a4ee832","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51c622a6-2d8a-5067-9a6f-dbe54548f266","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e553323-dc1c-575d-b528-bc2543ce323d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read96s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read96s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b57bc80b-4da6-5011-9006-6dd6d8a4bf35","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read96s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read96s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38fcfe7b-9ebf-5436-9aa4-f5bfda1af7cf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16627931-7f4b-5e03-b097-b0578bd14f1a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--390d55e2-979a-51f8-a528-5f80a9369138","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24bd4aae-14cc-5d5c-98e7-f6a01cb1e33e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a6695c-aeb1-5e9b-9105-4cb13d6c14e3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e190f8c-db55-5afc-a906-c0a5016985f7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81301be2-454e-5121-aae1-2a1b1b50f962","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--117122b0-d425-52dc-8dcc-c748947f8f76","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38438ef1-2f4e-50dd-8ed9-3abee8c5a699","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a0ed87c-b0d1-5378-b3d2-aa103874f8ae","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0619cc0-6234-53e7-a0a4-3fc5a846a981","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e09f0cb-e93d-5fa8-9f01-45b36ade850a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f67651d-9538-5315-b4e3-e196170c3d98","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e794e41c-f423-5550-9205-2073c07c5347","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a2b3b73-b15e-52c0-af8d-d783c85e533a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d5ee28e-d18e-5769-a8fa-afb54d4d8f98","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96f856b0-3296-5f28-a25a-37ab5fc40885","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--094d622f-ef77-5afd-9746-aee3435937fb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb26a937-275b-5bf4-88d3-e876608261f8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07a9765b-2574-5eba-a5b8-835ffebaa4b3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--922bfbc5-01a7-5170-b0bb-2c7c15d017e9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5ba36c8-0027-57f8-b811-eee182594a9a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03da8574-db60-58c1-a1bb-7db922c8c651","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read67s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read67s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c8c6884-ab4c-508c-97ae-3cc5920ca60c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read67s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read67s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38d7eb72-5407-5438-b293-a3f89efc9e7e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f68a8d3-ea44-5e94-98ae-38641519c07f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa104ae1-a0d0-5c1e-8b0f-aacfdc2bffea","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--215dca9e-243e-5adf-938a-08b82b538372","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71dd6c30-4369-56f5-bf80-d9b430ea5a74","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1816c5e-68eb-527b-adf7-ba4f678f435f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dc3edc3-c6e7-5507-b78b-c834a447ad24","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2850dda7-a2b0-5437-a58d-f6f95ead2966","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63bf2bd6-0402-55a9-8aeb-a3d130260096","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--253cb848-0bc3-5ed5-a8f6-837cd13ac8c3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9effd3-3d44-57ec-817b-757ad994729f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b20a0189-79d9-5032-9a13-b55e6bae6fac","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f366c2bf-6c0e-5bd7-a0ce-327d7b736b97","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b044222b-240e-5be9-821f-699b68c41f28","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a796f863-caf0-5081-b775-e26f4273746a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3be4a62b-5978-5fdb-8978-2e8281177a21","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27ed0d22-507d-5164-b5c5-5f556b94c109","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d14fb762-7b30-5070-b23b-b0863e812d51","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff49ca1f-4fb2-5bf6-ae84-b2fe7208b0d4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5c5f284-d0ba-538b-94f3-ece169ccd49f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62f8f41d-1290-5f29-a6cd-e2e82c0dac5b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--936b09e4-8377-5316-8b41-0faae2033846","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad93d7b2-6d16-5c8b-bd9d-324132c5ff4b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule58s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule58s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71994c46-a054-538d-b0eb-391a9ebee830","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule58s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule58s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46738ab9-8eec-5b8a-add2-f38c74fb8fc9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b301ab5-3bdd-5f77-8af4-5948450c89b2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96a895cf-a68d-5d44-8b65-d93ddc6cd47e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841587ff-1545-5662-a1fe-69c6192f8fb5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e1637fc-dd50-50ca-b65a-afb3ffb01665","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule27s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule27s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--222313a0-fd24-54c6-85e6-52e277a4a0ad","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule27s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule27s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9765b9d9-ca0c-535f-b6af-38f51eed045d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48e3272-9141-5320-adf8-c71aedb517e5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d493949-cf71-5b4e-8964-a4dc0610907c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5904c361-e7e8-5388-9518-5d342ecc67c5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b9f5a37-6299-5078-8772-8e68743d66a4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3f541fe-e871-56cb-a906-8d1efa74079d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38a083e0-1fcc-51da-94a5-2814f1960dcb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9670ee9-b407-593d-8771-c7ca715c7d3e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e287047-841f-563b-9e08-6e0f9ffb038c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--811f88c3-4125-597f-ae28-a56663844cdd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14e2cec4-a1bf-58db-9898-a33c23fe88ce","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbd8444-e423-5586-be9b-6b2f9b34b117","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1671b6b7-c174-5aab-9cf8-2d2b5fc93d82","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule37s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule37s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d36007f1-b62b-5e8b-a90a-b83df1b116da","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule37s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule37s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a631bf11-b013-5562-986b-0b34d6517539","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--162ad467-11e6-5823-ac35-8aa93e5ef3da","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841d9fb4-aee2-51f6-8720-66d99697d5b3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4588889e-4a38-51b6-967f-419713217b69","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d05b77ef-4df7-5396-b4c5-dbf15dfed697","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule34s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule34s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40a42f52-4498-51b0-9cc9-a20c6ee97fe4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule34s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule34s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--351ecd86-ea2a-59cb-93aa-603e732b6eb8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00ae8acd-295b-5882-abb7-9a718d98da97","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d5c2a81-f28e-537e-8bf9-005c0c386d00","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff9b8cd1-1ce6-51d3-aeca-b9dd614b5b5d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--949c3244-cc8e-5dfa-9ef3-9aa4012e3456","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a8479cf-5578-5534-acb1-86ad8eaa9ddb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5f8ab63-d37d-5566-adc4-0ca9493ffc61","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule7s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule7s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b0adda-ae30-5b8d-bd37-33b71546baf9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule7s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule7s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2143a90-6e0b-5fbb-a16c-db3a4980654c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--375ab33f-55e2-5820-ae6d-5d7539d20b12","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3b07bb4-5e47-55d1-8f95-df7b1faf62d0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d47d2238-30c9-54a8-8ad1-07535842abcb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--426d4833-f83d-5127-9a66-da5c593ce756","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--436aadc3-92fe-5430-a27b-80dca609e0bd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f59cedc3-9111-5e6e-a625-878f2af8340c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64566a16-204e-5e96-bbc1-626a113228bf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c21fc86a-dfb9-5f48-b021-a67fd92dffe6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be45977-3edc-5563-97f1-baffb9262676","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--275b06ed-3ecb-5a60-9739-80a2e389366e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76b72d8-95ef-568e-882a-99abac3a618c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85073b33-2dd0-5ace-8bc6-3e44c0341f1c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read0s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read0s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8504c32c-964b-596a-b602-52b30e7ecf9c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read0s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read0s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d8e9e81-a33a-5ec9-85d2-97bbea692480","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--322ce8ec-816d-5025-a26a-52ceeed4157c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a45cf90-a1c7-5b6c-be09-8c980fbc56f4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86e4c578-a199-599b-b879-afaa6c43fff4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--843b3d7d-cf83-57a3-930e-2ff08363973d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule16s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule16s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dcdf50e-5f47-57bb-8e8f-98e6a2dcd1c1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule16s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule16s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63dacfa4-5f18-58d3-8607-a649e5ff1944","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22c39ffc-ae84-50c7-b98c-b27835c84ca6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e47f794-e35e-52ef-ae0f-c3e9fedea9ae","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43e08363-c119-5d90-90b2-b924dee1ce01","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bec1556b-8829-5d2a-89e5-c15f2429caf4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57ac9a36-528f-50bc-93f1-f096c835aa91","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c63ad486-2100-507b-b52c-df49b6e5f400","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51c8380a-e9d8-56d5-bf68-73600b316ea8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a4e82c-d4b2-58f7-9dce-8add4e52272e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f199153-f70d-5317-8307-951e12a4f1bf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0c7f0c7-5c26-515f-9d49-7efd8e44de8e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66fe6359-1065-5dfa-b87e-1efa5cf4d8bc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5440b0f1-8e25-5ae2-9f1e-b493bc319c51","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4a35081-7870-5c2a-bc56-bd4c2dbce582","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d759df6-61b2-5911-b0ed-735b7cba108e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44d0cf9e-6742-5f98-9b72-09f3db6909f7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6e15fe4-d899-5177-8c93-26f4d424b0c4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12abda72-31dc-5b9e-b3e7-dc6c8c9f972b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b54eeac7-eccd-5bc1-9593-76cec1c4ede4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--816626e4-6838-5127-a6de-b196cb4f54bb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81bb65a3-73d3-53f6-93ce-b57c9bf2b594","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd84c8d-b298-561d-a89d-7ac95a02da59","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f30152f4-a069-53bc-9daa-35f702b15a69","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64a7b023-3896-5952-b54e-9d554463c189","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3983d509-afa7-527b-a829-97e0431c1c0c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f87e46f8-696f-5d09-882c-d9e6ffc32375","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c84f7e11-599b-5fe1-bf0e-aefb384ec9b0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57ac855f-f15d-5a46-82c5-6ef932f619a7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5138157-7eed-5873-99a2-9fdb29dcf809","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--431b5723-4d85-5865-90e0-5071f1ea0c78","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f0ecb3f-127d-50e9-8505-42e0bd289e2d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b504e50b-6a77-50c3-a919-6feadf527407","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89583e92-3211-5801-b314-758ef44dcb2f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe30b9a-3ca9-5cba-beb1-a7c3a50da5fa","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f05f055-0a86-5d10-be63-6446b8029e42","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98a6f6f6-c8e4-5974-9c1e-6e243f71aa81","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ccc1615-f707-5271-a32e-e320867a7e0a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--692210a0-af6f-56c9-b9b8-81bb6c43918e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d419774e-6ced-50d3-90af-bb84e1b785bb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d933ce21-1a1c-5bff-ac81-2e9e7a317e6b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5567b164-cf98-5f99-bcec-f28a1485fc07","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6e6eed-c6cf-55e8-b41c-1b00a82e01bd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec926b47-0c09-5ae2-9045-f27a37ae7018","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d06bc52-a968-52c8-a4cc-9ddd660b6d92","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6faccfc1-59c6-5444-8729-c189f808e678","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--444fcaeb-75a0-548b-a332-f080dc720cb6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1133a873-7ba6-5ce6-a813-f8f26dd843b0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fb42eac-4e90-5612-bea3-667730a6ba10","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5e3f50-48d8-5d88-bf7e-3c3a9ee122e2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--793ca300-2782-5131-9303-f394e01ca8da","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3551b0a8-f72e-55c5-b1ba-d9f704a36904","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"rule50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rule50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--730087d3-e315-58da-9de4-750f29ea668b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://rule50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rule50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8f2fc6f-afe2-52bc-992a-606f828f7151","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"read28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'read28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32e51de0-08f7-511a-8f1f-45e659045c9b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://read28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://read28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f7a32bd-6c23-52f3-a0ec-92bd346edddd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6737c45-b3d9-5ade-94ef-319244f8b6a3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--582c7a82-1511-59e3-978b-7dc3b35154c8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e579ebde-1938-5eab-85dd-31c35b041f7d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0129c128-1795-5942-8730-e8bf9699ea43","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ac55d21-955c-5c4d-8609-89192fd1a9c6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e2184a1-df1e-5100-9cfd-732125d96730","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d7bc17e-3ecd-591c-912f-5024850ced5d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f4f3d0e-01ae-53a0-9bcb-24ea395e858f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6162dcfb-f173-55c0-aac0-e062507e00f7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e40cd8-3409-5ef2-9540-7eda1e57a547","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b156c0fb-c219-597d-9ed8-eb3454f9312d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3cae8d83-2471-5d4a-947a-ecaccc359d2e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5058fdf0-6354-526a-9e41-cac43ee07d8b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b309599-7edc-56d9-bf07-64320b5fd612","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c035292b-fc44-5c13-962e-101d99b1523e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31495f46-b666-5efc-b9a2-34332869b5c5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30aad68e-59f6-5a0a-acd8-fc9e1b38f0a9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a72a7af8-faeb-5fd7-ac59-658caeec6e40","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine91s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine91s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88052bfa-c614-55cc-9b5a-7ae8af37244e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine91s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine91s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c978484-0b5c-5a51-a213-e68a5552bda2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fill75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fill75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--503f73a7-4d1b-5c7c-8239-1def18b41322","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fill75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fill75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00000589-0ba5-5442-b3d3-9ae97e378d91","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine98s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine98s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6a363ed-3f9c-58ca-b39f-4a90d7e5898e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine98s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine98s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01d960d3-9275-54a6-878f-aec0184efd2e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9840dd15-b99d-5724-8170-c0d41ab9be0a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99a66856-bd90-5303-b53f-86d93ad13a7e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8cff856-1f22-5ae4-a296-b1c4997e2f37","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine84s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine84s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--356df8cf-9cc5-5ecb-b162-6adc38e988f5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b62af07-9f12-5b8f-bf39-a9560938c958","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be7b2539-d269-5a27-b23b-37305f7b3b20","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ceade4b-ac3c-5eb8-b890-a7c5eedc6a2f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96e673a4-43cf-525a-9c43-8648abb9c429","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bc0a5ba-b541-50c5-81bc-638d9f0f5ccd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5032c79-1aa9-526d-bea9-49203c28fdcb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb49d2d-5dd6-5ee9-a274-e35dabfc9730","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e9a69d3-50b8-5aed-bda8-52a41df0352d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1135f482-7c27-53f9-9ea7-a62ebaccda8a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2fd05ba-61f7-54bf-bba1-ea4a31296300","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d24e110a-9ce8-537a-9358-77dc00377d02","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--108b4f2d-c18d-52d7-b6dc-a619cb419271","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--455d20a6-abcf-583a-ae87-b12106c4d357","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f3a4ab2-746a-5909-b1af-fe778242c867","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d86bd32-6e03-5624-a358-a22bd8878c86","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b0c0cd6-ff22-505c-8fe0-bb350c4ab027","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd65319-1e04-5e1b-968b-13cda3fc6cdc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31bd6372-f366-54b9-a82e-7ab29c06590c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine96s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine96s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43c86058-4572-54e0-b1a0-890b1539b9c0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine96s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine96s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c9f1588-6c38-57f2-99bf-c258e6c14477","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4886ff4a-0d7f-59b5-ad5d-81876faa045c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f523baa-c071-58a8-ab22-17a35af1eb39","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67a2e1e-56ca-55de-86ad-20c057cb8d92","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b4d7ce3-6f29-5475-8184-461fd9b41c93","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f657c7f0-236e-5d2d-a1e3-3dab80755ac0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad3b4d0f-4d58-50a9-bc7a-532fe00fc5e9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32148218-39f6-5e40-8652-7d8d7e001aba","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2ba02d-d001-5bb0-82a3-cb084e35cefe","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--588295f2-ed20-5f58-b092-73445948eb46","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e643a68b-e0ed-5950-a30b-2b13b13a9d3f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a92117ca-9777-5322-902e-2b3f2ef993fe","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6685ad5a-dafa-5938-9226-713dea4a8940","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18402555-be9a-5249-8851-79290bce35bb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e0fcb45-11a7-52ed-a872-405c16a30bcb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cb1be0-6f5c-5ed2-a734-af88db1b0fef","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa26bba4-8b65-5925-9bcb-17e014c6d772","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d4b2b5b-8c61-5e13-85dc-87f1c144b06f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fedae129-9ccc-5985-b599-e37ac441a6e5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--030d682d-23df-526f-9f62-4b1ed3cec096","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b23b0a0-64ce-54be-8cc5-08f1cc62a402","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1ba3821-719f-572d-9a83-c40c511cb248","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b12c5013-e033-53f3-91a0-39bc87559ebf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fill50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fill50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e435742c-6db3-566a-bf2f-d22fb24ab83f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fill50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fill50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b75ed26-b14e-53d4-8a7f-b225cd0bb382","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"com-accountsverify.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'com-accountsverify.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7740424f-b329-59eb-9f8d-b870b9eb36eb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://com-accountsverify.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://com-accountsverify.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61e95a77-e93c-5b03-beff-c55eed9d9c69","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"mexc.com-accountsverify.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mexc.com-accountsverify.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8297f6c5-e218-5788-99c2-711bad5da13d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://mexc.com-accountsverify.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mexc.com-accountsverify.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75bec82f-366b-54be-83db-c3cb99575d5f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fill29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fill29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--501cac21-2f6c-577b-8faa-32a7203e41ff","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fill29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fill29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae43f0f-4fbf-553a-aa2c-9af9704f7978","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fill7s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fill7s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53cac76c-45fd-55a2-bd53-ed7bce4d4549","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fill7s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fill7s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7067f96c-576e-54f4-9f00-59f37d1d3ba7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39e0be18-d4cf-58ad-9107-046a4dfe69af","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c74335f-45c1-541d-b9b8-1c683b2b2206","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69563ef6-b307-5c28-a431-ffa7c3f68fa8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44b42cf9-957c-559d-ba4e-d03674091f6c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fine9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fine9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99cf9ae5-e797-5f5d-b23e-fb8c5b03eb41","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fine9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fine9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82c52a9d-67dd-58aa-811d-f60bf54d3a82","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c120927-5fe3-5b13-aeb3-430e21313b4f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcfc1672-26d8-5699-a235-cb3b377ea393","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8002ed8a-4468-58a3-a170-e5f7ed1fe917","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64565cab-42b5-5413-84d9-c8ede3a90778","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9902ff48-3e0f-5020-bd0f-37187641b980","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c69d829-42b9-5e4e-b8c4-3e2a2bee5390","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--452ede3b-ed0e-5a17-a108-5012d511d9dd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--957a1639-2b14-5560-87cd-91526086b4b4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc5c758a-d18a-56ef-b3e9-0a1822420c62","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2e3213-59e8-50a7-9220-6fa84f413462","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f713fec1-bd1a-57b8-b3b4-97adee750ebf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9043a2-6ed3-5cbf-89f2-14f14d0b2d50","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"find42s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'find42s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--477e9206-f625-53db-80a3-3d863792225b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://find42s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://find42s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c69c7e53-8f15-58db-8399-43b070829d87","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"elecviews92.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elecviews92.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--96a31419-0371-5806-9cf3-c9fceaf88496","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://elecviews92.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elecviews92.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc60df8b-6b41-5775-9ae2-811e3ee8a5b9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"base2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'base2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8547654-9e61-5adf-bd02-4412942b6a04","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://base2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://base2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e15c9f04-c092-5e1d-b7e1-060d28b94acb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"base24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'base24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4efe6d59-11ec-5a8b-a811-676ea83e688f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://base24s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://base24s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a93ab7ad-d741-5ade-a05f-0e1b6b3528f3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c9d78b4-a786-5c57-8214-c25924c65a26","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--866a7bc3-eef5-5be6-bee3-32300543470f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b81db72d-8d5e-5dbd-93dc-24a6c06a2044","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--227a94e5-34bf-5fb9-96c3-0203df050d3b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dddea4fe-1b55-5809-9684-2441ad1be4e0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--851aba52-4984-5a32-be65-5c3f40eb7741","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10ae22e7-3b8c-552a-9409-635afb1acaa8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fe95672-43fd-542e-9ad7-c7cbfece0825","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b174708b-e73a-5e7d-ab5f-f0aca5ec3dfc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch81s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch81s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13cbca77-4115-5876-96cf-8d9ea97e16ec","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caeec101-52d6-5631-a519-1a3ac8269b01","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e922493-522d-5cf2-a94a-e99f41ad741a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e3c8f2e-6e76-5aa4-9a96-09f251d8c558","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f994b1f-c257-5877-a2e7-afc76fc74e18","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a59caf5b-3f0d-528c-a512-ae4c35ab95e8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb18427a-1cbf-5c91-b545-b54f7ed41470","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ffdc8e-b081-5072-b556-8f0d2f924ead","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6a7ad11-41e0-553c-89dd-a25b1d6a9800","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"poll87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'poll87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33128c17-8761-59bc-bb71-c039d2845f01","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://poll87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://poll87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c946196b-4373-5a20-a809-7ffc69385f17","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"elecviews27.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elecviews27.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64734869-1aef-59c2-8ead-80d3656fc081","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://elecviews27.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elecviews27.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f01da079-cbca-575c-931a-f1432739ad61","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"elecviews52.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elecviews52.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e059b5e-62f2-5927-82cc-15adeeda8d01","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://elecviews52.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elecviews52.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c52623a0-0d06-5503-b325-4d8db89df2e8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"elecviews20.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elecviews20.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92574b51-7e39-5f41-8f7c-750e3d7d3a36","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://elecviews20.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elecviews20.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abd2bfdd-33fc-5c4f-ac98-f87346f29b1c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"elecviews78.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elecviews78.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eddb2501-0b32-5656-8237-c5ae74a6ee75","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://elecviews78.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elecviews78.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--503be347-d2b5-55c1-88ae-14dab0d94546","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bfa461a-f603-5548-b286-f1e28887452c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch53s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch53s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bacdba55-0253-5ca6-b690-2d4d19386de5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--979e53bc-6922-5f0c-8fca-3f948ed0cc57","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch41s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch41s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59f2af5e-23a0-5a95-b105-148b7fde15d9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5674a7e-edb4-521c-97b6-ea9d45153595","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a995dba-0616-5aea-b4e0-2d2dd8accfc7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65226566-7054-5882-9537-20284e332324","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e46d386f-55b8-55e3-8216-8e4c089b90e5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87b675e9-cdf8-5b7f-809d-5f048d8530bd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a447f340-ae22-50ea-95c4-cc5ccf4d45e8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d66b862-9135-5c8b-86a8-ae766c15435a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fbf7af4-3ecc-56f9-8c4b-737083b71a3c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--895d3c04-fc01-5878-ae3f-629f469326bc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70d0879d-f9cb-5d8d-8007-51d0a9c9ee5c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4edbb2bb-792d-5b31-b59d-32029c2abe23","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch60s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch60s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb3640b7-44dc-5879-a0fc-093b573db5b9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f18b9b43-3f5d-567b-921d-f7a82132b329","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch48s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch48s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78345308-0a0c-509c-98ff-ce9a7fb4185f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0da6d47c-7a52-51fe-aab4-1b95efeb6598","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cbdea9d-c57a-56b9-b309-85bda83806d9","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5ea4a12-6bcb-5bb5-b827-9bd0ea5a98fb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65423a63-fba5-5d30-b24a-f34c0649d301","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ca01d5f-2377-50e1-945f-c8acfe525cf2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a805ee2b-d349-5f86-be17-dfa90ee77593","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d25b1a63-be7c-5baf-bcde-b3cfcba22ebc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch55s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch55s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d56ba182-6f15-5ade-9a49-75f9f4e23442","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b020c6d-34a0-59f9-a115-ef3604c62539","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch46s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch46s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fdf3a032-6c74-5804-9eb7-b5ec1c67e6c6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6468af9-de6c-5cdb-abba-296c1beb064b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b479d50-000b-5c5a-9aef-10a9fec4f46e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d44131a-7add-5099-9fd6-df843366659b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch61s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch61s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--388ce28d-4d02-5c97-8edf-0ef652cd1279","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cc902c0-537f-5f0d-81d4-da5ae193e6ff","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch43s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch43s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df56a478-cd4b-57e5-af57-0e0f9ec5e1f5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c36c324-0925-5dc5-8a18-78d9dd32cfa8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66801eb9-c8c3-57ce-bb2b-10ac417cf86e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch58s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch58s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f177b29e-cbf5-5c4c-b380-5c2960848c38","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch58s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch58s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12dffb8e-5116-5c91-99cc-1b425a4d09cf","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fbf1af6-c0f2-5f45-b9ed-4d94f436452c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eb15ef0-2801-5c98-838f-44a72ef604a8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dab5d85-2aaf-5a70-9397-a4e8c7aec6a5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch97s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch97s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04b9e877-1232-5702-9628-cd6e133fd1f6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--021460c6-85b7-5c74-9116-12ef5e33c0a8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch54s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch54s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b30f248-77b0-54f4-8bd8-dbb17e8dc895","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40cd8f7d-dffd-5e6e-b6a6-e2ae3a8e1037","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f01f8674-78ad-56d9-8023-0a263f05a941","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09721b42-f725-5e46-9821-145e7b886d83","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch63s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch63s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa0c3a92-e77e-5de2-ae8e-0fac3ee2ee85","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0c92ee6-88d4-55db-b8e6-4611b3f671df","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b282ff5-3e95-5f39-907e-30f85bc28376","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c02bf087-4334-53b0-b349-78904b959e0b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch93s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch93s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7946b148-da53-50a9-b0c7-312a79495d9c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--653fb823-f701-559d-b685-aeea84c07252","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch78s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch78s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--009c77c7-f5fd-5723-910a-d1b1d0e538b8","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d4a2eed-d87d-52a1-94d2-980cd0b4b5d4","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d839ab8b-248f-5b6c-844c-a6876c1a3020","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d107d446-44d4-562f-8902-8e7ff81efbfc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch71s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch71s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a37ee6d-9960-5d19-b42c-7d60607dd995","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--705e700f-72d2-5cdc-b665-9f100d9c4c0e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23b952cd-ccea-55b7-9d76-617bd082114f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--124d83d0-e728-5051-9a2b-371d5823e86d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e2c14f6-5de4-5039-b79f-c62c8403b7c1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--964f957e-40e6-5180-93c9-982544c33113","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch76s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch76s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--521748c8-6af7-5a22-bfe0-afe7f5297306","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61fc5dcb-47bb-50cb-9518-e2081bae1c49","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6eebf22f-6111-59e6-9ba3-086bea1ee2a3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eac585e4-a67c-5462-aee0-974080e4e539","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch70s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch70s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfbc9ea0-b540-5f6f-9b0a-6661dd7e7a54","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afd3c114-c837-5c74-ae6f-d1f19905ad60","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch66s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch66s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b48b3c3b-2935-559b-b782-9b63846cf100","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1fbba96-c325-5afb-842b-072246d0d552","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1344bd33-0a6e-5633-ad41-adb071929409","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch67s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch67s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e358974-5b1f-5b86-8450-cd9cecb3028a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch67s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch67s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d979246b-9b07-528f-bf73-643468c5cf1c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--054c698b-8796-5566-84f9-299b888b3b72","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af6401d3-42ca-596c-804a-ec8fcb8920ad","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0743b0bd-619d-5d86-8535-f34e77db7110","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch64s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch64s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b75e7f0-12c7-5c20-9ee4-e85952e61b28","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24120b56-c054-5489-8f92-ee16f3485164","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3821b8f2-1443-509c-a20c-e8543be55674","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8759fed8-bfbb-5cce-9954-500ea427fffd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch2s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch2s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052818521093034401"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99be7dce-b094-5ac1-9c57-e95706de03a5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43b4b82b-e61c-587c-b0b3-d60fafdef33b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48cd0810-4a45-52f3-908c-48a4b04c7c19","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--440cf056-eee0-5924-a278-948d4bd7bcb2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--662e57de-9ec2-53c5-859f-f5b5996a3174","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch34s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch34s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0776a435-5a6a-563b-a310-8b794bb86655","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch34s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch34s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54c768c7-a74b-5792-843a-5c93f27cea04","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eea26c58-a141-566b-ace3-a78b1ac0ea6c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch59s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch59s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e39f8183-1117-5abd-8815-9c6ff34a7095","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adeaf928-6f05-5972-8955-c55b8dbad1dc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ab837683-a588-573c-89ee-f7b2d616a0bb","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f80668c-08c1-5847-b0c9-4eca1d0ae1db","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--987b3bc3-3671-505c-a148-9f9c41e6a478","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6217302c-08c3-58b5-8b34-a6285b5da033","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d57a8e19-3d9d-502b-9bd8-5be281bb769c","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d60a85b4-edaa-5ae5-9c81-59a11d3ecc5e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daa56012-21c9-5dd1-9bd2-09f1f7205c35","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12f5c8b-98b0-56b1-b614-e444cc2bb039","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7ef76f1-390e-5c91-84c7-95545294ee68","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00e65c88-1f16-5f69-9a11-f30715b14ace","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e3de584-aa50-5e57-ab89-d5266d974aec","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c219376f-675f-5de1-9c9c-a9c582b472be","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b535ee54-1134-5ecb-b141-c6061393e5f3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aa70795-5f3e-55d7-b453-22bb45750221","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2959b4b3-a38b-5577-912d-b8bf707bdc7b","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67ccac5d-d55b-5b85-89ca-9e37b46e6d34","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ba0236f-c246-57c3-8c1a-1ddf21910ff1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61cc49cb-6f20-5bec-b594-f93b142de6be","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch15s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch15s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ca84f7e-336b-5580-99d5-ef9d43bf5439","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89b38a74-eef5-541c-8be4-29fb921b92ae","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36b1b375-fb49-5800-9ab5-ac5ff5463e0d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85cb1af8-f3c6-5faf-926e-17b7d5c8b699","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0129ba80-d069-5f90-b23c-60f7c828b137","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch6s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch6s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac905d14-24c7-52eb-88b7-06fb88cf5cb3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch6s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch6s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c725c5a1-cfbf-5717-84aa-49e4bef3d4bc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f36d4986-eba0-56cc-bbff-783736133ac5","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a87627-dd73-55aa-aed6-d7f6f5f47435","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c84eabd0-1de0-556a-baa6-4dc745a1e0c0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch14s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch14s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0509f06a-0bcf-5f7f-923a-0ddef8f19ef6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3d5bc6f-453e-5932-b908-0ec659446af1","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch30s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch30s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c90c431-4a3e-5e72-988b-d886390e0993","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f291d6cd-766e-5d8c-a266-7d4627582cbc","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4893cc43-5c79-5363-88e7-a51215da672d","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b52c6b3c-53b6-557c-a77f-0f536c400b39","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45f1f011-8435-5247-b821-ad58cff37200","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a73b27aa-2c1b-5e05-b3a2-3867b24f16c2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ea9e1c6-49e5-552e-9533-3ecdb0482369","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch42s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch42s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51c26a14-9327-5132-ba5d-2a884871abc7","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch42s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch42s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eec5198a-e710-5fd3-bb49-a3b593d34940","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8789863d-cde6-5664-9512-ec2b1519006f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08f9ada9-b27d-56ad-a4c7-49aea8f6143a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ecd33d76-8206-5eba-8981-28b43a8bfc51","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch9s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch9s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec8fad7a-b37a-517e-929e-faeaf929dae6","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fed701f0-25c3-5fd2-8b56-434319f2d6e3","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cd75556-dd15-5c19-a06c-d34cf20602c2","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3ca5b81-d36f-5c39-b2fd-26c5208681c0","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e22fdb3a-5a1f-54a1-ab9c-faf55624c963","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6ed070c-644e-5980-bcab-02e44cad405f","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64155232-eeeb-5fad-912a-476d9bbfca8e","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"fetch16s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fetch16s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86494cb5-3f06-5e10-9a3c-b7052b478e90","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://fetch16s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fetch16s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--567a68b3-9eab-5d5d-b799-bec68c0751dd","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"try45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'try45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9037756e-f5f8-50e4-90e9-7c2c52369e3a","created":"2026-05-08T18:30:00.000Z","modified":"2026-05-08T18:30:00.000Z","valid_from":"2026-05-08T18:30:00.000Z","name":"http://try45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://try45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2036427645370441731"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cf2758f-0de8-5143-9098-1b8b28af1fe0","created":"2026-05-08T19:05:00.000Z","modified":"2026-05-08T19:05:00.000Z","valid_from":"2026-05-08T19:05:00.000Z","name":"dee823048e88af86ae251242ce0de3cc","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'dee823048e88af86ae251242ce0de3cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2052827129709285777"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--585f1847-a97b-5fb0-9a88-fa815fdfb492","created":"2026-05-08T19:26:00.000Z","modified":"2026-05-08T19:26:00.000Z","valid_from":"2026-05-08T19:26:00.000Z","name":"Kingdommarket.live","description":"IOC reported by @DarkWebInformer on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'Kingdommarket.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/DarkWebInformer/status/2052832612121444580"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3626930e-710f-560d-be36-99e0f3084e17","created":"2026-05-08T19:26:00.000Z","modified":"2026-05-08T19:26:00.000Z","valid_from":"2026-05-08T19:26:00.000Z","name":"http://Kingdommarket.live","description":"IOC reported by @DarkWebInformer on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://Kingdommarket.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/DarkWebInformer/status/2052832612121444580"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--60c163c0-d1b5-5436-93be-44071dc9d7d0","created":"2026-05-08T19:26:00.000Z","modified":"2026-05-08T19:26:00.000Z","valid_from":"2026-05-08T19:26:00.000Z","name":"Kingdommarket.so","description":"IOC reported by @DarkWebInformer on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'Kingdommarket.so']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/DarkWebInformer/status/2052832612121444580"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ec8a805-0b11-57b7-ba4a-eb1c34c7ce5c","created":"2026-05-08T19:26:00.000Z","modified":"2026-05-08T19:26:00.000Z","valid_from":"2026-05-08T19:26:00.000Z","name":"http://Kingdommarket.so","description":"IOC reported by @DarkWebInformer on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://Kingdommarket.so']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/DarkWebInformer/status/2052832612121444580"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddcea50d-8353-5e6e-b6b6-155602a20593","created":"2026-05-08T20:00:00.000Z","modified":"2026-05-08T20:00:00.000Z","valid_from":"2026-05-08T20:00:00.000Z","name":"competent-franklin-c73842.netlify.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'competent-franklin-c73842.netlify.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052841003510268367"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b74ea3a-1c91-5809-903d-847c5c02f851","created":"2026-05-08T20:00:00.000Z","modified":"2026-05-08T20:00:00.000Z","valid_from":"2026-05-08T20:00:00.000Z","name":"https://competent-franklin-c73842.netlify.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://competent-franklin-c73842.netlify.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052841003510268367"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c93e0f9c-2667-5a66-83c6-47cba57992b2","created":"2026-05-08T20:08:00.000Z","modified":"2026-05-08T20:08:00.000Z","valid_from":"2026-05-08T20:08:00.000Z","name":"01914660a0d11ef40e0d4bb43dad84716a9ac859097d73bfd15d66bab8f33b7d","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '01914660a0d11ef40e0d4bb43dad84716a9ac859097d73bfd15d66bab8f33b7d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2052843116642660718"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a33863-40d8-5617-b41f-ef05bcc2ec97","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"pw3a.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pw3a.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8dc359ba-b25c-5387-a203-eaa5bc1f5c7a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://pw3a.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pw3a.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57790b38-dab4-57c9-8a83-3cceef5bd438","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"dkjtxz.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dkjtxz.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1248d76c-0106-52a3-9169-44aa2aea4959","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://dkjtxz.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dkjtxz.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b6680e6-58e9-5515-b71c-f91ba710b6b8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"v1till.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v1till.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a86afccd-5646-5544-8973-89f62910276e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://v1till.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v1till.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21761de-7b8a-54a2-9457-3ca2e240b3ff","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"eofmfd.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eofmfd.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3583ef47-1b29-5dbb-a32d-a47b329fe6af","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://eofmfd.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eofmfd.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cae035e-098e-5b6f-9da0-11a6400d4769","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"elnmgi.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'elnmgi.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00e12071-919a-5f89-befb-be411bf355c7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://elnmgi.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://elnmgi.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77403790-6121-5dbb-9d95-fa31285e61b3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"fgxlo.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fgxlo.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff1579c8-7da7-5aa5-83b8-2e8327c7de4e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://fgxlo.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fgxlo.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61f13b40-fd9b-5001-98db-41dc319fa3ef","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"rpxqf.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rpxqf.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--578cb53b-6ad4-5716-8b31-63d053cdb605","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://rpxqf.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rpxqf.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c39c0f2c-36ac-5bb2-abb3-591477f0e645","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a8f5c16-06bd-5696-869b-c26f52b2c538","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85e99a67-8c80-5ea1-9d18-eb92de9079d9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"6genq.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '6genq.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8553c7b1-f3d0-51f3-8fc5-028922e77a3e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://6genq.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://6genq.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f355ad82-4af3-53d9-8a30-c76517f797a5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"b1pog1.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b1pog1.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--940d05f7-06a8-5e2c-ad3e-1107d778b665","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://b1pog1.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://b1pog1.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0da769a6-3c2a-5e37-8599-f2617cde4cef","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"5d4c.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '5d4c.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b088e366-fcbb-5f73-8ea6-a608a7f69167","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://5d4c.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://5d4c.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1725fce8-4757-5810-bf64-c54cc30189ba","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"2mcwf4.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2mcwf4.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c29ae646-f57a-524a-8c08-fbbb5aa86f19","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://2mcwf4.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2mcwf4.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c656d7f9-5328-5400-8a2b-63e23ab1a20b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"0fo6.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '0fo6.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--408254e4-f1d2-5bc3-abb9-8bfb7e84f385","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://0fo6.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://0fo6.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86fdcc0d-47f0-500f-a24e-d07ed729b5fc","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"gd77q.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gd77q.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59e6aef2-6fbb-5d01-839e-e01986614d75","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://gd77q.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gd77q.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43989dc9-2dd8-50e8-8d8a-17ae7bc4cd4d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"jj7wwn.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jj7wwn.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37fec2b-eaba-5888-b263-d111dc19a57c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://jj7wwn.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jj7wwn.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98efedf6-b26b-53c6-b0f3-2e205f4b348b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"a26ma2.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a26ma2.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3c023bf-4d66-59ee-9e60-057281b847eb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://a26ma2.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a26ma2.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2be22d6-7f2d-553d-96b4-e8892d1badab","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"7l86v.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '7l86v.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--808ba0e1-cf03-5440-8389-2f2674e6aab0","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://7l86v.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://7l86v.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb0d1820-a9d8-5cdf-8ba4-0b2a159f68a4","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"m8lprz.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'm8lprz.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d5e3edd-994a-5189-a537-7d68b5ad834d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://m8lprz.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://m8lprz.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbe3c288-62f8-5e90-b642-3253738cb9d8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"67k57k.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '67k57k.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf4c22ce-94fb-50a5-a96f-1448a8312da3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://67k57k.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://67k57k.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c43828b9-81b0-549e-b91c-ea8182f3df32","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"r3zq3.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r3zq3.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f8b009b-bdf2-5767-8365-865494f63dfc","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://r3zq3.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r3zq3.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17917dee-f614-56f4-a9f2-df35b43ce552","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"urdme.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'urdme.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e304e97-8609-5028-af3f-6d321db73c60","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://urdme.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://urdme.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f995d45b-dbdf-5c8c-bf02-f8b64eb34f57","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"f85dt4.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f85dt4.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e45b57c8-909a-5713-b6d4-17063356caa7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://f85dt4.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f85dt4.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd2874e9-2b15-57ed-ba13-6733710623d6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"240np1.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '240np1.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--283d3f6e-6e41-5be8-bc6c-fa72c2d35a8a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://240np1.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://240np1.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a49f9792-760a-57ec-b570-42c5e61cc88e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"gpw354.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gpw354.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--178a876a-a466-5641-97e7-28416f4cd50c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://gpw354.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gpw354.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd99fe9c-5b3b-5152-99c1-077a08a7aefe","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"o37lxe.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'o37lxe.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7d27a21-5511-57a7-9749-a8e9e51f105c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://o37lxe.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://o37lxe.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc381637-0c15-5a8c-ba99-7ab176689e78","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"p1zzbr.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p1zzbr.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--edf1fad9-ffee-578d-b785-46432ea3aa0f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://p1zzbr.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p1zzbr.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccdbf79e-71ea-558b-b9f2-2051ba99117f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"kwcg3.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kwcg3.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a8919f8f-9907-54e8-aff1-5dcebae4f587","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://kwcg3.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kwcg3.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eca1aee9-de2e-5ee0-9c8b-044f84cf0b5f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"7d05.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '7d05.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--193b1a43-4729-551d-9185-9305997e9ab2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://7d05.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://7d05.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e1f9739-8306-5188-a142-cde896753d13","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"u2pi0z.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u2pi0z.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83d91de0-64c1-55ad-be68-d41bcf4359ec","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://u2pi0z.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u2pi0z.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f781bfc3-91dc-5ea2-a4fa-002a5bf95473","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"vxmmzr.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vxmmzr.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e377d692-1dca-546b-b7fb-15b779636778","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://vxmmzr.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://vxmmzr.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0c8c53-2b0f-5354-99ae-949827689522","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bckgp.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bckgp.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dca65f3c-ba47-59a7-92fb-3b28bf0b3a08","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bckgp.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bckgp.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aba9b2d6-d040-5362-a71d-53ae7c2a9925","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"rqatu.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqatu.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e92790b6-9d1b-5db2-8434-a068519cfeee","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://rqatu.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rqatu.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5c3120-5fb2-58aa-a885-3bb2895100d1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"4t79.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4t79.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77dbcf22-4c58-5d32-b5a8-bbdc58f1a627","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://4t79.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4t79.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b94d2c1f-4d05-5b84-9d83-303ea5bd14eb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"j527k.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j527k.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0609c39b-d945-595b-baae-defa32662609","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://j527k.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j527k.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68943b21-76c8-5044-ae86-2f144aed9899","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ri1unj.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ri1unj.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db73b2a0-e430-5ee3-a829-ee418577eb51","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ri1unj.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ri1unj.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73e4541c-7a68-5a88-bc81-c818ccde3139","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"k2448.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k2448.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5de186bf-1d70-52be-a393-631f2575a2dd","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://k2448.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k2448.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a77c4639-5799-5da6-9b6e-5d6fd17fb385","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"90d2vi.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '90d2vi.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--456df2cb-35dc-512f-87b1-e7c1d29bb6e3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://90d2vi.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://90d2vi.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6947d52a-06de-5f40-823c-3b418c787553","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"z1kvz8.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z1kvz8.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b695e89a-4f7c-50fb-87bd-bf4d283e14d8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://z1kvz8.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z1kvz8.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c7d0767-665f-5653-8cb5-fde039991a2d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"rui.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rui.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6735a761-cae5-5624-b3af-ef567d8086cb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://rui.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rui.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a962544-c74f-5765-be5b-c468d3e7c082","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"olw80.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'olw80.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cae499b-18fa-5e14-9385-f03c6c5ed864","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://olw80.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://olw80.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77fb4fc7-d695-59b9-b0ea-9ba077058fd2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"rjle.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rjle.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce294b59-7415-5b4a-8f70-436c83d3aa83","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://rjle.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rjle.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaf261d3-8cc3-5e12-b767-85a3d6853e7f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"nejdfr.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nejdfr.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a664a06e-c7d2-5d5d-8109-139ae77dd69e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://nejdfr.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nejdfr.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e8e9d56-a1c1-5b7a-87c1-2be2b7aaa7fa","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"nxaf.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nxaf.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--010b3ada-8cbc-5b4d-984a-68419a4a1441","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://nxaf.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nxaf.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d6bfe95-7e73-5103-b5f5-621b8fa320ad","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"xj06mt.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xj06mt.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5cdc053-a0e4-52da-b693-4314c32709ae","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://xj06mt.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xj06mt.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a23e01f8-fc7d-59b5-bb8d-ade8052f9717","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"8g7uoz.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '8g7uoz.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6603d17d-fff1-5570-8afe-26f6f8cc6d1e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://8g7uoz.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8g7uoz.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3782d882-23cb-5f40-b14f-d3445016da2a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"koiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'koiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a7e8615-86fb-5c92-82b6-248bff7e0099","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://koiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://koiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a562427-22e0-537c-a637-0b0bb4b74f54","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"gbd6n.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gbd6n.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--893329e5-42de-5f03-a5f4-4fc7bbaaf689","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://gbd6n.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gbd6n.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84037c91-04a4-58ab-a6eb-3bff8e2ae323","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"lzmjv.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lzmjv.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15f19a98-1738-52a5-995f-0a18aa21ece6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://lzmjv.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lzmjv.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e78faff5-d6da-5e01-9223-8c9095b7a34c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"axpi6z.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'axpi6z.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7250824-1ea1-5d40-8d5b-f17243badbb5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://axpi6z.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://axpi6z.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f946edfa-3deb-59bd-8384-4de1bf0f2a5d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f414557c-7c25-5140-a47e-5806cf3f989c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11e39f96-7527-54f5-9a10-daa6dda8e890","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"jd04fu.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jd04fu.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a37e1c1-7a22-57be-bcf7-96f37a188e01","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://jd04fu.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jd04fu.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dafd092-c126-5ff2-845a-6dbaa83a6034","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"08q5.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '08q5.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ade77b4-30ea-5a83-8cff-13cd9a7ff2be","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://08q5.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://08q5.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64b60b46-701c-5900-9d51-8916d4ac5a70","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"5971i.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '5971i.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8721ed9b-9c80-571d-9c02-4f4638426db9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://5971i.ewqtgf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://5971i.ewqtgf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6042d5f-cfcd-510c-a365-2f9bbfd07a6e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"vji71d.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vji71d.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e966dd56-ab2c-5487-8cfe-26863098a528","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://vji71d.sdwnsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://vji71d.sdwnsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9421d819-2d07-5a9c-b8aa-17a67198e73a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"jmpdats.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmpdats.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e82c4832-76cd-5b38-8821-141f8d915ebf","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://jmpdats.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmpdats.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72869e8b-f9c1-5ef2-adb1-6f435426a52f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.jmpdats.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.jmpdats.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--636a7b68-0c8d-5005-8eca-6a582e39b5a5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.jmpdats.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.jmpdats.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5185c4fe-1b2f-568c-b051-fffa43d5baa6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.domanse.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.domanse.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--938c5dcb-4cd0-5a56-bfc1-29c020bfc725","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.domanse.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.domanse.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64270551-063d-526f-9440-bb984acf50f1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"coimusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'coimusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0aa6cbff-4d21-5e02-b31e-d39416f800bf","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://coimusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://coimusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d86d26f0-994d-5d97-97fc-ba9c00ecd493","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ninusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8022ba9-eebb-5f3d-b116-21a7abc7508c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ninusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b97ff35b-cb93-5127-a75e-9aebf15053a1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bbusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bbusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6982d95-7981-5d56-9b62-866c3977f343","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bbusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bbusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ce04a2-ddcc-55a7-a5c0-04fe9b73a7ff","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btciusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btciusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee15f466-99b3-5bc3-b9ba-74a42e476f23","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btciusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btciusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9335a309-84ca-51fd-b767-71e23414b261","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"alamo-s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'alamo-s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4aa381e3-51b9-5d53-a687-00d0eadde4e8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://alamo-s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://alamo-s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62405ab8-b4c8-5ef0-8dd0-4d391db19456","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"alam-os.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'alam-os.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--339c8c4d-4243-5d89-87cc-e0d6e726e64d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://alam-os.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://alam-os.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7019d243-e4fe-5616-b16a-2d46645ef5e0","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee1f1a0-4df3-5d99-a5f3-cf7b79907a80","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb877fc5-0ec5-5461-b0c9-c1c9bf738898","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a836c46-fcfa-5a80-96cc-ec970e19f0c1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6dcd0b7-f368-5350-8c87-c546561e6bf8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ccusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ccusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a877c95b-bf5d-5000-8c25-53d888aaa03c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ccusdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ccusdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706426c8-af9b-5b24-a525-f2d6fd932cd5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ciousdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ciousdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1521f85-5b54-54eb-b057-477a0c4275f6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ciousdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ciousdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5399d4f0-a884-5d69-918b-a05647c8eea9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"mousdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mousdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efa3f446-37c2-57d2-ad64-6859a06365ad","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://mousdt.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mousdt.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6fc3d25-fbce-5b9f-aa59-28550f5a66c5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binanceo6.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binanceo6.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08889670-5e8c-5af9-94ec-72db7aed85e1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binanceo6.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binanceo6.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--289f90df-2aec-5ab0-a147-12cb67516b56","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binancen4.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binancen4.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3121fef0-343a-5751-a4cf-ccf090069c86","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binancen4.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binancen4.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3683ceee-0231-50f2-9376-eb508e6e1403","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binancee2.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binancee2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd2d9df-cc76-54c3-966a-79fa54beb2b0","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binancee2.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binancee2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--afa1d972-7720-5e74-ac22-bb12a7af7fdd","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binancez5.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binancez5.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb0ab496-7049-5032-98e7-35e381c75d12","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binancez5.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binancez5.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc2b1339-3859-5b36-a517-6db776b0c31e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binaccem8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binaccem8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7db68d93-cc67-5927-8c45-9ceb1785ea3b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binaccem8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binaccem8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d781de-4473-581e-9424-f4d36be0d632","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binancev7.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binancev7.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75b69db8-3b7b-526e-9da2-41fd9a08b66a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binancev7.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binancev7.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bca23fd7-4c42-58ef-9c12-efe45a4047bb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binaiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binaiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a095e65-2a3d-55fa-814a-ec4a4f160755","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binaiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binaiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8130f280-b186-5e73-8807-64ee99df3213","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"erssegd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'erssegd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58c58c06-c1e2-570b-9ba3-a529eb1393e9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://erssegd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://erssegd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1ae540c-cd0a-5016-be32-097f084b8cf6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.erssegd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.erssegd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88f2ba97-37b4-5788-8f03-b7ee58a94063","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.erssegd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.erssegd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd347e4b-52f5-5569-825e-f7afe1d31a5e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"biiusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biiusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4fede0b-80a8-575a-b69b-57326bf86990","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://biiusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://biiusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e4f544e-ac63-58d1-8e7f-b6f4deaf213e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"biniusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biniusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7a054ed-53cf-58db-8e11-eed0fa71d45c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://biniusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://biniusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b078683-7810-5d39-97e4-96132a6ae09d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"biniousdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biniousdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2daef5b7-8c75-555b-9a01-5b2cc20fbd0b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://biniousdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://biniousdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a58788c-eaee-596b-b0af-03212c418d60","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybousdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybousdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f9fcf64-2cbf-5d6b-a943-be0d0fed5fde","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybousdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybousdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bd79947-19a0-5bf0-8e9f-6835fea8d356","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybsusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybsusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16319098-ee4c-533d-b29c-b476e3f359fe","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybsusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybsusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc5f9cf-149f-5c61-b201-a3a781fff8b9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binlusdx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binlusdx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64b10dd7-3c2a-5847-9d8d-a9eaeec305ee","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binlusdx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binlusdx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa1fda29-f54d-5435-88f6-f5edd3b79e45","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bintlxusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bintlxusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--287c64fd-d8ed-559f-b7cc-968a950c032c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bintlxusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bintlxusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d66179bb-3670-574e-95f3-24eed505b147","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binxusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binxusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90ce7384-cc4b-556c-a99c-aefd7eaba6d4","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binxusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binxusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bc999a6-458d-5d08-af90-f127c495b4a9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"xinlusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xinlusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6216f552-b24b-51bb-8405-ca2377e87dcd","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://xinlusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xinlusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8da91f49-9815-58ed-b952-93609b29c84c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binccusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binccusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21007726-efd9-5983-bbf7-c8b9649f1c09","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binccusdc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binccusdc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff582a8b-6bae-585e-b4fe-c4b83e102479","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"japfc.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'japfc.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75c551a6-a192-5aa7-94ce-97ff5abf4628","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://japfc.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://japfc.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31e03a55-f550-5ff8-a846-9be3705dd06a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.japfc.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.japfc.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6546354e-7185-52fa-840a-23c8a5a38b8a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.japfc.top","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.japfc.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d3a1af2-072a-557f-99c3-4eaff9075619","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybssusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybssusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f99de0-ffce-53ea-a40a-f70d8db74540","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybssusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybssusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--627940dc-02bb-58f3-b821-0295a42c0d49","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bholos.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bholos.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2439ee78-b409-5476-93b5-488b4a2169d2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bholos.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bholos.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f48c056-8b78-5f90-9fdf-58f33e723289","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bhonso.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bhonso.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2898e6a6-c32f-595b-be2e-232bd87f140f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bhonso.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bhonso.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bbc49db4-53eb-57f4-a24c-e7d8acff74ea","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"prsjmp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'prsjmp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8349e833-b611-5470-946c-e3234f3fd829","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://prsjmp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://prsjmp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00d10406-cea9-5fe4-9404-885521ef9f21","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"injmps.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'injmps.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--021a11ce-e140-555f-addc-215f28668db2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://injmps.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://injmps.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cb42d72-c36c-58bd-accf-a0244d9fbcaa","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ffgydc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ffgydc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0f5e7fd-d9c8-5709-88e8-8e6ab61edeef","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ffgydc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ffgydc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aa45352-1ab2-54cb-a94c-f3208163c6ae","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ousjms.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ousjms.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9dd6e222-21c4-5aea-9db7-608711ede1b3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ousjms.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ousjms.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--747d8c31-9836-54df-ba05-11db5c527cf2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"jmpwes.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmpwes.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d983f7ee-ab21-519b-b731-fe9b325ad143","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://jmpwes.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmpwes.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a93006d-6dba-5931-ae20-d9428d3ef836","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybaausdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybaausdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5ca164a-fe4a-52af-adf6-d0df524cb826","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybaausdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybaausdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ed82a82-3fe9-5d88-baba-c5474d73a3d3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"osfcsl.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'osfcsl.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d472e877-501e-5a66-a897-4e0e57b561a8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://osfcsl.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://osfcsl.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ede502f-d9f3-5915-8100-6c60d540e303","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"deomns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'deomns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf25444f-6030-5306-865c-59d8387db15b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://deomns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://deomns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56321341-01f2-58de-ba14-db702d8b03ae","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binllusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binllusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a11c053-5d03-5810-a5d5-04f23ef0e0cf","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binllusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binllusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89a4f76c-0f3f-5ce8-8aab-a77006638905","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybopusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybopusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f828117f-d313-5aa4-994c-03be2698e541","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybopusd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybopusd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f324b684-1a78-5a9c-9db4-acd32766989b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"dioeue.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dioeue.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b13a5b7-1a01-556f-8a4b-294a9dc6f8b9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://dioeue.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dioeue.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ea6ac8-4e50-5651-a5ec-44aeacfd22d7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybiiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybiiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3a05409-d33f-5881-b364-913749cea039","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybiiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybiiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e84c723f-b408-52f1-9b62-d29cf3838b23","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binyyusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binyyusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f31993e9-1edd-5051-93f9-efbcc2300a48","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binyyusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binyyusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--581f05e9-7d70-5a4c-b78c-c1b51db9f2a3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binttusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binttusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d06bcfe2-b92a-5759-b78e-0aeced421316","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binttusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binttusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c97443b7-536f-575d-bde6-4758b2de829f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binvvusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binvvusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85c3a766-1883-57f8-848c-6f5fe85722d8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binvvusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binvvusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdfc6633-fe5c-50af-a527-f098c2442270","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"goixsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'goixsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d598251-2304-5ef7-bbfc-8951a69cbd7f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://goixsd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://goixsd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--002bbfcf-d2f6-5eab-a329-89a552df8753","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"nmiuiu.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmiuiu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de18fb44-68d2-53f6-95a0-d370624120b6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://nmiuiu.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmiuiu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eea84e10-5ac0-5f51-8671-7fe010234cb1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"douiox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'douiox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d97975ab-fa96-5994-b8fd-4a0e9e9e752c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://douiox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://douiox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e829d1d0-89de-5e75-a852-419129b57fdd","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"koiucd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'koiucd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee599176-6dd6-5c5c-8c88-59ac7de5309b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://koiucd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://koiucd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2705fef2-41e5-5f14-b4be-5b04258a8675","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb751e9-745e-57d0-bf9b-7714decdf2ab","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--419267fa-d8a4-5d8a-8094-4d4163acfccb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7b6efaa-04d8-5a27-89ab-266e912a87b6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db446dda-23dc-532b-8e6b-297c683215a1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"expmns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'expmns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7360ac9-604a-5b37-87dc-ab73b973e314","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://expmns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://expmns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fca59647-9d76-57d3-82fe-f0696e20e22d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.expmns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.expmns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--192e2e50-4d07-57a9-b7d4-19941b38f246","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.expmns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.expmns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e767330e-4800-5fd9-8e6e-f4d064b53083","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"lin-bf8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lin-bf8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70e04dcd-2021-5f44-a6f1-99f8383100e1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://lin-bf8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lin-bf8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b1112b1-f9de-5c93-a13b-53a2f9075676","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binalusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binalusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8ff4de0-ebfc-5300-9df5-6dd6c2a40a81","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binalusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binalusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64c1990f-2695-5030-ad5a-5bd905d59f72","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"th-binks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'th-binks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e4b0546-6914-539d-9285-9b081d700ab6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://th-binks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://th-binks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abfb0635-ae07-5124-a136-830e8d1d0263","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.th-binks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.th-binks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--754283dc-c1cf-5df6-b8f6-79c3e9c0bad2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.th-binks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.th-binks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91122aa0-fac7-5c8f-a026-f253f8a4eb48","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.lin-bf8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.lin-bf8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52f8d51f-e1be-5862-b1fe-356711c3e011","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.lin-bf8.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.lin-bf8.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39f4d976-a79b-5a04-9478-deb74b23cccb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.jn-fc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.jn-fc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f3bf5f1-9103-5f5e-989d-16340c182a15","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.jn-fc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.jn-fc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69df96e6-7a34-5f33-94d2-b83b56812ed6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.ttkx-bx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.ttkx-bx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca154f28-4fb2-53bc-8f47-e694e4bc1f3b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.ttkx-bx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.ttkx-bx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--945e0755-374c-5afd-bd3e-16c8bd48cda9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"yl-ch.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'yl-ch.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bd7ab0d-7f0a-591f-9f3b-4c2d3aaf8396","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://yl-ch.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://yl-ch.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91bcf8be-fa02-5b02-9e9c-c9263cabc21f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binkusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binkusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9042f36f-41e1-5605-83b5-b1f4f43d8ac1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binkusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binkusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99752ee1-96c1-51fa-8121-0feba61a95bb","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21fa86e7-bec1-5ddb-9439-b6c90316ff5f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ddba4a2-3882-5026-b33e-a3873d095eae","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ms-stypso.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-stypso.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a348c9c1-2aca-50c3-87fd-49f34e5dd027","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ms-stypso.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-stypso.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a914c8b-2549-51dd-aba7-fa4facfa9919","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"cio-r.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cio-r.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f648919a-972a-512f-b24d-f006cdb9d533","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://cio-r.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cio-r.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c77e6f20-f999-5aaf-b4f6-04c8ed5fc37e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"cio-a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cio-a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8580862-1907-522f-bd09-8def5ecb83f5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://cio-a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cio-a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02428adc-2004-524e-92f0-76e23ce58830","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ttkx-bx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ttkx-bx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fb13c32-945b-5641-8a7a-1d7e02074a97","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ttkx-bx.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ttkx-bx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e43464f-e2c2-5ed8-895d-d720dd19f03e","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"domanse.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'domanse.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df5e0a10-efc1-5ce8-8fcd-81f33f9dfb38","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://domanse.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://domanse.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04ecb48d-2f69-5c45-b345-159f34a18b60","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4f809b8-b119-5f03-a1ca-0444c6063fe3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29987555-c94d-5545-a4d3-52642e8a1a84","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43e2b47f-b941-5244-a47e-a26b718bbcc7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae9e57b6-7dbb-5440-b260-65e978dc9b18","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ms-tesf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-tesf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c24b3282-e446-5b4d-b88f-f5330b23b495","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ms-tesf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-tesf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--586fa203-02af-5a20-b01d-fe6d2b8959dc","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ms-txs.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-txs.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--729c75f2-2134-5beb-8a62-77caa97f31af","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ms-txs.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-txs.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90cce179-40c4-5967-9cd7-55adb25b7781","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"txs-ms.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'txs-ms.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ded7bd62-b638-56b8-8901-f7a2fc6bdd2f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://txs-ms.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://txs-ms.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--255503d0-9ffb-5def-9605-7a7ba28d1385","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"ms-csypro.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ms-csypro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25d4be69-f413-52d6-a3ba-949b0d9e5b66","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://ms-csypro.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ms-csypro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d7ef24c-4c77-5299-8035-13a2479a37ae","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"nec-a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nec-a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--394eb4db-da5c-575b-bbf6-db7dcfa50804","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://nec-a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nec-a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5323908-50f6-5854-b674-57fce0bb442c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"jn-fc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jn-fc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7388d0c-efe9-50c9-b2ae-c12afd2b8ab9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://jn-fc.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jn-fc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3192f43d-8e5a-5b3b-877e-5ebdada26786","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05fa1020-a12a-550b-9f72-7e032a96f695","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--241e2935-8301-5525-a5ad-488ce81930dc","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"chat.ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chat.ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--730c1e94-cb8e-5a4f-84fe-ed842932e4a6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://chat.ms-crypto.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chat.ms-crypto.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d78e26c-7dd0-54c2-9925-9ae8c8c0c827","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"byblusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'byblusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c3393f1-1996-589c-bed0-abc8145135a8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://byblusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://byblusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4268c53c-4b70-509d-9c20-682a88e732c7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b9c0be6-c7cc-5049-93fd-6aa17193e290","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybiusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybiusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0e6d229-6c6b-5c5a-9c7a-75ae7d308a78","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bao-fua.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bao-fua.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c05b318-5301-5a9d-87e6-c8caaefef422","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bao-fua.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bao-fua.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--448e1d35-abb6-5704-8b45-86bab1718eda","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaan.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ce7713-ffd5-5738-b414-6adbe3eb06a0","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaan.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaan.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3e4d28d-97d6-5a97-9112-7273b8aeaa58","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"chat.cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chat.cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f78dd01-cd86-5f49-9c53-aff2391bada3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://chat.cionusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chat.cionusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c5a554b0-7a14-5676-b14f-13b0efc39452","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaav.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaav.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be048035-ba2e-5952-af19-2ebe7a560328","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaav.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaav.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--988209f4-b6ff-5f73-861c-89770aeb18b3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binvusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binvusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90f4eb7c-74f3-57ba-89bc-11f3469d3a70","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binvusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binvusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2bb602f5-a037-5024-801a-3d02a46e10ff","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binanusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binanusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e93f0796-bbf3-549d-810f-0e4a11fd0562","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binanusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binanusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14b879e5-a057-56a6-945c-65b8f3dd9d7d","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"biniusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biniusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91967096-a720-5fe4-b3c6-bfceda9f5245","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://biniusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://biniusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7cca81d-c435-5135-9fd6-b2e3d317e330","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bineusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bineusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6006129-fc2d-5d7d-801d-a75a78ba3fd6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bineusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bineusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76727a0b-6c26-5699-9642-3b0de70f6bc9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binbusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binbusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0955669-0a75-57d8-82ee-86c8c6b6ae4c","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binbusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binbusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54bc2a2a-f241-5a29-af47-607713ba1a40","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.binbusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.binbusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c757f766-fc38-594d-b82d-d7db5da202b8","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.binbusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.binbusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5683230-fc59-5d31-bdd2-2db3e150d2d5","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"api.bineusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.bineusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38cf8272-cbd6-5a57-b5d3-a13ad3f2af50","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://api.bineusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.bineusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--297d6792-e7ea-5244-8e06-28ea436d7c5f","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binmusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binmusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b4da2c9-f792-530f-b7b3-5ca9f23c23a3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binmusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binmusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3ff9dfc-ae26-522e-8919-bcfabb3610fa","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binhusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binhusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42eae01-1369-554c-a2f7-19199399248a","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binhusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binhusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28b3b100-c10c-55cc-bc03-5d05d6486c77","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binlusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binlusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfbc1d44-bdb9-5c7b-b105-06114bbf40c9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binlusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binlusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--935d0207-1641-5ca8-85f0-0b11508b44a1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binjusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binjusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--083d6071-b487-56fe-9d2d-956541cefbe9","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binjusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binjusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f745a9a8-fd25-54e1-b4b9-964979face50","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binzusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binzusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ed25b35-6748-537a-8069-e4e182d792ab","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binzusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binzusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42261db-26dd-554f-b39a-b11b0e1896d1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"binxusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'binxusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--722106ec-fe00-5c91-8941-e21a44449606","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://binxusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://binxusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed68e634-1d84-5a1e-b543-3fbf72807f21","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bybnusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bybnusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f321a83-dcc4-508d-aaf9-38fa7b03e448","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bybnusdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bybnusdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81290409-c1d3-5d56-b380-8d0f3491eb7b","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaax.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaax.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--292a862c-1a25-5fe4-8371-76eb0d495fd1","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaax.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaax.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0355a876-868b-5458-a67f-67d4a6249fa7","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaai.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaai.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--316f0e5f-468c-5b1f-b258-6b10a8ba3d78","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaai.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaai.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddf5497f-b96e-5cc2-aeb2-a1dd67540364","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaac.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaac.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7421c233-8d3c-5a7a-96f4-cb976c77f6a3","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaac.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaac.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62ded166-b93b-5371-a79d-2d50b9ffa7e4","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"bnbausdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bnbausdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8d58099-d318-5be4-8cfa-d8f882a84c70","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://bnbausdt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://bnbausdt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10c84eec-6ac7-5ece-95bc-dbf9abb43942","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaaz.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaaz.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e425b5f-5042-53bb-84f6-abc0e331efde","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaaz.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaaz.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4798e0e-108b-543d-8ea5-031bbaf989c2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaal.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34538bdf-7c3f-555f-9291-3b33338c9d86","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaal.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0366425-fcd9-5e7f-a0fc-aca2627b34c2","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"btcaae.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btcaae.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78ae1de8-f4d5-5ca4-a4fd-f5ffe0e352a6","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://btcaae.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://btcaae.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4432ab6-0caa-5077-a238-d93bf62841d4","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"http://34.150.85.92","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://34.150.85.92']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c936bc5-2e9a-5e3e-846f-76a3658539a4","created":"2026-05-08T20:38:00.000Z","modified":"2026-05-08T20:38:00.000Z","valid_from":"2026-05-08T20:38:00.000Z","name":"34.150.85.92","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.150.85.92']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2052850540275736854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63547a5f-33f6-5427-9ea8-1c5a3041ebea","created":"2026-05-08T21:30:00.000Z","modified":"2026-05-08T21:30:00.000Z","valid_from":"2026-05-08T21:30:00.000Z","name":"http://45.157.233.103/phantom.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45.157.233.103/phantom.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2052863651166495135"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--35e736ac-1bc0-5c6d-b1d9-0a295a3d5011","created":"2026-05-08T21:30:00.000Z","modified":"2026-05-08T21:30:00.000Z","valid_from":"2026-05-08T21:30:00.000Z","name":"45.157.233.103","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.157.233.103']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2052863651166495135"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--05d2cc67-fcd3-50e0-a140-ef0c12a9a990","created":"2026-05-08T21:30:00.000Z","modified":"2026-05-08T21:30:00.000Z","valid_from":"2026-05-08T21:30:00.000Z","name":"3b67ea25fe8336d31ff480af4c857615","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '3b67ea25fe8336d31ff480af4c857615']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2052863651166495135"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c36c455d-e469-59e8-a955-85b01a3dacf1","created":"2026-05-08T22:00:00.000Z","modified":"2026-05-08T22:00:00.000Z","valid_from":"2026-05-08T22:00:00.000Z","name":"service-sso-kucoin-vdn.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service-sso-kucoin-vdn.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052871215576990004"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e923c993-31c0-5c88-ad5c-f4749ea76b22","created":"2026-05-08T22:00:00.000Z","modified":"2026-05-08T22:00:00.000Z","valid_from":"2026-05-08T22:00:00.000Z","name":"https://service-sso-kucoin-vdn.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://service-sso-kucoin-vdn.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052871215576990004"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--749fcfde-9c90-53a9-9e13-b11225be260d","created":"2026-05-09T00:00:00.000Z","modified":"2026-05-09T00:00:00.000Z","valid_from":"2026-05-09T00:00:00.000Z","name":"redstoneciugafhoureon.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'redstoneciugafhoureon.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052901443397455959"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4311bd07-6f83-5f65-b315-1fdff91732e9","created":"2026-05-09T00:00:00.000Z","modified":"2026-05-09T00:00:00.000Z","valid_from":"2026-05-09T00:00:00.000Z","name":"https://redstoneciugafhoureon.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://redstoneciugafhoureon.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052901443397455959"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f86c13e-842c-52ae-b9d1-b7b7be4a2c0f","created":"2026-05-09T00:14:00.000Z","modified":"2026-05-09T00:14:00.000Z","valid_from":"2026-05-09T00:14:00.000Z","name":"http://65.109.55.181:8181/login","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://65.109.55.181:8181/login']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2052125969305964749"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b224f47-107a-5197-9691-d5e45594dc4e","created":"2026-05-09T00:14:00.000Z","modified":"2026-05-09T00:14:00.000Z","valid_from":"2026-05-09T00:14:00.000Z","name":"65.109.55.181","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '65.109.55.181']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2052125969305964749"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6c923c-d2b0-51ec-bf70-dcfc129b8123","created":"2026-05-09T00:44:00.000Z","modified":"2026-05-09T00:44:00.000Z","valid_from":"2026-05-09T00:44:00.000Z","name":"seblevqc.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'seblevqc.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2052912615483977791"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d70a406e-efda-504d-975e-8139774d0078","created":"2026-05-09T00:44:00.000Z","modified":"2026-05-09T00:44:00.000Z","valid_from":"2026-05-09T00:44:00.000Z","name":"https://seblevqc.com/HomeIahta/","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://seblevqc.com/HomeIahta/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2052912615483977791"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdde6b43-69b4-5f0f-a44f-de00ce6a96df","created":"2026-05-09T00:44:00.000Z","modified":"2026-05-09T00:44:00.000Z","valid_from":"2026-05-09T00:44:00.000Z","name":"185.38.151.11","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '185.38.151.11']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2052912615483977791"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce08ea2-d785-518e-be0a-3afcee823725","created":"2026-05-09T01:04:00.000Z","modified":"2026-05-09T01:04:00.000Z","valid_from":"2026-05-09T01:04:00.000Z","name":"lapkalulunet.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lapkalulunet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052917504914428012"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cfc3eaf-4a3e-5598-b1b8-5165953de9ed","created":"2026-05-09T01:04:00.000Z","modified":"2026-05-09T01:04:00.000Z","valid_from":"2026-05-09T01:04:00.000Z","name":"http://lapkalulunet.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lapkalulunet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2052917504914428012"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--487d0c69-b737-5b39-913c-147af59d1070","created":"2026-05-09T01:15:00.000Z","modified":"2026-05-09T01:15:00.000Z","valid_from":"2026-05-09T01:15:00.000Z","name":"137.220.152.149","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '137.220.152.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2052920375433166889"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb17a52-d1f1-52ae-a80e-7870b9d59402","created":"2026-05-09T02:00:00.000Z","modified":"2026-05-09T02:00:00.000Z","valid_from":"2026-05-09T02:00:00.000Z","name":"xfdyghudrsr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xfdyghudrsr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052931614955524233"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae59256b-4eb5-53ee-83ea-820fe39af821","created":"2026-05-09T02:00:00.000Z","modified":"2026-05-09T02:00:00.000Z","valid_from":"2026-05-09T02:00:00.000Z","name":"https://xfdyghudrsr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xfdyghudrsr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052931614955524233"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b7bfb83-696e-529b-ad0b-5026fe1635d5","created":"2026-05-09T04:00:00.000Z","modified":"2026-05-09T04:00:00.000Z","valid_from":"2026-05-09T04:00:00.000Z","name":"roblox.com.ge","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'roblox.com.ge']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052961828322390318"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15a2786-f88e-5258-bb99-ee9aeafd5bb9","created":"2026-05-09T04:00:00.000Z","modified":"2026-05-09T04:00:00.000Z","valid_from":"2026-05-09T04:00:00.000Z","name":"https://roblox.com.ge/users/6964421643/profile","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://roblox.com.ge/users/6964421643/profile']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052961828322390318"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33cb076d-3e00-5166-a755-6c81a1a11f99","created":"2026-05-09T06:00:00.000Z","modified":"2026-05-09T06:00:00.000Z","valid_from":"2026-05-09T06:00:00.000Z","name":"mtech-kobe.co.jp","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mtech-kobe.co.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052991978971824314"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d3d18c2-d7b9-592c-ba99-c315e0fcee2b","created":"2026-05-09T06:00:00.000Z","modified":"2026-05-09T06:00:00.000Z","valid_from":"2026-05-09T06:00:00.000Z","name":"https://mtech-kobe.co.jp/wp/wp-content/plugins/eilfsigbjy/vv/globalsources/index2.php?email=","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mtech-kobe.co.jp/wp/wp-content/plugins/eilfsigbjy/vv/globalsources/index2.php?email=']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2052991978971824314"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d31dacb5-dea0-5a67-b550-a199bcc7d2de","created":"2026-05-09T06:55:00.000Z","modified":"2026-05-09T06:55:00.000Z","valid_from":"2026-05-09T06:55:00.000Z","name":"cf-mufg.xvfsf.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cf-mufg.xvfsf.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053005919760404755"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17e27380-9d45-5597-b0f5-445a8faf55ba","created":"2026-05-09T06:55:00.000Z","modified":"2026-05-09T06:55:00.000Z","valid_from":"2026-05-09T06:55:00.000Z","name":"https://cf-mufg.xvfsf.com/%F0%9D%90%A2%F0%9D%90%A7%F0%9D%90%9D%F0%9D%90%9E%F0%9D%90%B1.%F0%9D%90%A1%F0%9D%90%AD%F0%9D%90%A6%F0%9D%90%A5/","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cf-mufg.xvfsf.com/%F0%9D%90%A2%F0%9D%90%A7%F0%9D%90%9D%F0%9D%90%9E%F0%9D%90%B1.%F0%9D%90%A1%F0%9D%90%AD%F0%9D%90%A6%F0%9D%90%A5/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053005919760404755"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deeb011b-ff42-5ceb-8df3-319c103c6a3d","created":"2026-05-09T06:55:00.000Z","modified":"2026-05-09T06:55:00.000Z","valid_from":"2026-05-09T06:55:00.000Z","name":"195.86.16.166","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '195.86.16.166']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053005919760404755"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2547e2b6-8989-5e10-a6e3-5c89cf0b7111","created":"2026-05-09T07:07:00.000Z","modified":"2026-05-09T07:07:00.000Z","valid_from":"2026-05-09T07:07:00.000Z","name":"http://185.99.255.17","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://185.99.255.17']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053008837645627745"}],"labels":["Hookbot"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48eb91d7-c7f4-5345-ae51-26b2054622ea","created":"2026-05-09T07:07:00.000Z","modified":"2026-05-09T07:07:00.000Z","valid_from":"2026-05-09T07:07:00.000Z","name":"185.99.255.17","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '185.99.255.17']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053008837645627745"}],"labels":["Hookbot"]},{"type":"indicator","spec_version":"2.1","id":"indicator--066e430a-4321-5ab1-812b-450d83b89609","created":"2026-05-09T08:00:00.000Z","modified":"2026-05-09T08:00:00.000Z","valid_from":"2026-05-09T08:00:00.000Z","name":"uniicatt.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uniicatt.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053022192472911916"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77cbe6a1-77ef-534b-a9c3-f4d4c1b7bfd0","created":"2026-05-09T08:00:00.000Z","modified":"2026-05-09T08:00:00.000Z","valid_from":"2026-05-09T08:00:00.000Z","name":"https://uniicatt.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://uniicatt.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053022192472911916"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abb58814-0ba0-572a-8148-285421d4d617","created":"2026-05-09T10:00:00.000Z","modified":"2026-05-09T10:00:00.000Z","valid_from":"2026-05-09T10:00:00.000Z","name":"welcometouhcglobal.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'welcometouhcglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053052410541580501"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb8b2555-c7a7-5a4c-bf35-1b7a42e0dd7c","created":"2026-05-09T10:00:00.000Z","modified":"2026-05-09T10:00:00.000Z","valid_from":"2026-05-09T10:00:00.000Z","name":"http://welcometouhcglobal.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://welcometouhcglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053052410541580501"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2ff369a-a8e6-52bc-ac4a-32e8db4616dd","created":"2026-05-09T10:05:00.000Z","modified":"2026-05-09T10:05:00.000Z","valid_from":"2026-05-09T10:05:00.000Z","name":"50.16.16.211","description":"IOC reported by @404LABSx on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '50.16.16.211']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/404LABSx/status/2053053781143605251"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31966a68-d61f-526d-95db-9f1b1312129a","created":"2026-05-09T10:26:00.000Z","modified":"2026-05-09T10:26:00.000Z","valid_from":"2026-05-09T10:26:00.000Z","name":"sidrachaindexteam.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sidrachaindexteam.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053059018722013667"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfe4a523-73b0-5ea6-beb9-add3373116a2","created":"2026-05-09T10:26:00.000Z","modified":"2026-05-09T10:26:00.000Z","valid_from":"2026-05-09T10:26:00.000Z","name":"http://sidrachaindexteam.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sidrachaindexteam.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053059018722013667"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e629ff05-c5e8-5e8f-acfe-b19e7afe6ca2","created":"2026-05-09T10:32:00.000Z","modified":"2026-05-09T10:32:00.000Z","valid_from":"2026-05-09T10:32:00.000Z","name":"podcastambassadorsprimes.ct.ws","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'podcastambassadorsprimes.ct.ws']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053060453085905117"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c856cd6-904b-5517-a796-8052998a5c78","created":"2026-05-09T10:32:00.000Z","modified":"2026-05-09T10:32:00.000Z","valid_from":"2026-05-09T10:32:00.000Z","name":"http://podcastambassadorsprimes.ct.ws","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://podcastambassadorsprimes.ct.ws']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053060453085905117"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc27c8b4-f4a1-5d1b-ad31-cc0236c7b7cd","created":"2026-05-09T10:40:00.000Z","modified":"2026-05-09T10:40:00.000Z","valid_from":"2026-05-09T10:40:00.000Z","name":"appealxdecision-x.team","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'appealxdecision-x.team']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053062487700906403"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--582aa716-8559-5ef9-9f77-84e7b3570789","created":"2026-05-09T10:40:00.000Z","modified":"2026-05-09T10:40:00.000Z","valid_from":"2026-05-09T10:40:00.000Z","name":"http://appealxdecision-x.team","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://appealxdecision-x.team']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053062487700906403"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e94758f6-70bf-5ac2-a078-eeaab9722190","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"hastesbuy.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hastesbuy.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2648fe1-534c-5697-8eec-70a38d7fc601","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"http://hastesbuy.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hastesbuy.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6068c5-20b6-5caf-92dc-72725a8b5021","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"agesbuy.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'agesbuy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c70d4cf4-ad40-59a0-ada4-2aa7411afa70","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"http://agesbuy.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://agesbuy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74bf02d2-bcfd-54fd-b3be-890994b43110","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"badadan.netlify.app","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'badadan.netlify.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89432ef5-753b-5d58-9b1d-c010ac03f6b7","created":"2026-05-09T11:10:00.000Z","modified":"2026-05-09T11:10:00.000Z","valid_from":"2026-05-09T11:10:00.000Z","name":"http://badadan.netlify.app/app.apk","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://badadan.netlify.app/app.apk']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053070014648049981"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a437e01b-cdbb-5b20-9f92-d375b3539761","created":"2026-05-09T11:27:00.000Z","modified":"2026-05-09T11:27:00.000Z","valid_from":"2026-05-09T11:27:00.000Z","name":"lider-3d.ru","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lider-3d.ru']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053074472756760659"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f202434-d24b-5ab2-8d1d-8f346261eeff","created":"2026-05-09T11:27:00.000Z","modified":"2026-05-09T11:27:00.000Z","valid_from":"2026-05-09T11:27:00.000Z","name":"https://lider-3d.ru/downloader/index.php?id=BVUmmHNWMPtIEcv48dEJr6BH","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://lider-3d.ru/downloader/index.php?id=BVUmmHNWMPtIEcv48dEJr6BH']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053074472756760659"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f566918-7edf-573b-b30d-251f9021dd45","created":"2026-05-09T11:27:00.000Z","modified":"2026-05-09T11:27:00.000Z","valid_from":"2026-05-09T11:27:00.000Z","name":"5d706781fc6bb741045e8db41d0a8d9b6252f2908aa0e5df2595795a64e6c60e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5d706781fc6bb741045e8db41d0a8d9b6252f2908aa0e5df2595795a64e6c60e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053074472756760659"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a2edd99-b473-5b86-b5ba-93bdc122c9f8","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"133a79e9094c14c0f41378c712fd9a3f7687e5ab6f781bd5fb94774e64f4b48d","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '133a79e9094c14c0f41378c712fd9a3f7687e5ab6f781bd5fb94774e64f4b48d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a194f1da-c86e-549d-acc2-c2baabc88064","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"2367fe508e8cd8ab57ac65d532ad036f99d11222cf9e06a74d8f54c68931926b","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '2367fe508e8cd8ab57ac65d532ad036f99d11222cf9e06a74d8f54c68931926b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5859ba24-66b2-5296-8445-aaac9824ae2c","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"15234d5912b39b3fcb25a905fc863ab647e6558e95d553fae8a84549201b9c84","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '15234d5912b39b3fcb25a905fc863ab647e6558e95d553fae8a84549201b9c84']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--36c8758a-325c-51e6-bad3-e29beccc781c","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"3299196b4913f068eeb93e7650a5cf5bbb10244be1e14724abb967d52b625d1e","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '3299196b4913f068eeb93e7650a5cf5bbb10244be1e14724abb967d52b625d1e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fad2281b-8c19-5490-8343-546b2fae12e1","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"260b52ce5e3a5b9f3c77b700ad4341b77d999c574962dff4c5514f2caaa4923e","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '260b52ce5e3a5b9f3c77b700ad4341b77d999c574962dff4c5514f2caaa4923e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac780578-3770-5cee-96f9-035549486f5d","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"37be3c5511017c2c7cd4023bb2385cbb2c6a0aa53c5bc6b18781cb6c208a482a","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '37be3c5511017c2c7cd4023bb2385cbb2c6a0aa53c5bc6b18781cb6c208a482a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf454988-04d8-557d-9353-d03cd91e1128","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"3a725e7ee8e57eebee5a95b1ead945e49ae456f2aba8ef43b597c3fad16b0722","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '3a725e7ee8e57eebee5a95b1ead945e49ae456f2aba8ef43b597c3fad16b0722']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28b9c8d3-2e28-56ca-85bc-09fa7e5368e1","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"381755b623dd7a4c2b5d80aaf40d7083eea727dd1f473545539029656ca81817","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '381755b623dd7a4c2b5d80aaf40d7083eea727dd1f473545539029656ca81817']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ab27cbf-3e51-5639-b6ad-3af922368bad","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"47ca3a45f082d84429266dc4eab72d0476afcfa46f62678ef97b7446b1bd94c3","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '47ca3a45f082d84429266dc4eab72d0476afcfa46f62678ef97b7446b1bd94c3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce7e6415-f541-5196-beef-8c13777e1385","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"5639dd46a65243cab1ccf62d42df1322f1d5df13c4f6142ba43902f6760343cd","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5639dd46a65243cab1ccf62d42df1322f1d5df13c4f6142ba43902f6760343cd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--43613727-4b66-5478-a8d1-636733acdf45","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"6948923b6353d20e61acd2a6e6370630b7dc95edc1fb252fd4bd510a68bf7889","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '6948923b6353d20e61acd2a6e6370630b7dc95edc1fb252fd4bd510a68bf7889']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4af58f1d-d5e0-5cf1-b1ee-7f9b090ae676","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"7adaa5460905f9475039ab7724a5a66e7d35d456118fd35086ca1ef03a7d0a9e","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7adaa5460905f9475039ab7724a5a66e7d35d456118fd35086ca1ef03a7d0a9e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--38aedc7d-0483-5324-9ffe-6a30dd32fcb7","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"8047ce0c7566090d522b034ada16cee1febbb08cdaf9a95363e46c6e11f29139","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8047ce0c7566090d522b034ada16cee1febbb08cdaf9a95363e46c6e11f29139']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3e11b6d-44df-5280-a8e6-ac4c935995d8","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"8ce84443a023c6afe22f14f0b6c56d76f53e09540c0d628a2f47e4f0fa981aec","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8ce84443a023c6afe22f14f0b6c56d76f53e09540c0d628a2f47e4f0fa981aec']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fee1d92-7288-5208-9071-f01f7dd077ab","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"9241da7f3f4bff47e6682940ad073afbf66b9ad1246ff9c191759c3281077f34","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9241da7f3f4bff47e6682940ad073afbf66b9ad1246ff9c191759c3281077f34']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19fc3ced-baaf-5937-857e-05452c746a2f","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"94bbe5961689a597ccd716281012fcedb189356140bbc641451a8b7132f41e68","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '94bbe5961689a597ccd716281012fcedb189356140bbc641451a8b7132f41e68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f85bfa2-af79-535e-8598-f569ee06198e","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"a133809a768c7c6b958d72ff6857677b14ed6bf284b99dc81a121442dfe04f90","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a133809a768c7c6b958d72ff6857677b14ed6bf284b99dc81a121442dfe04f90']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd65a761-09b2-50f8-a7a4-0978070e8116","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"a873c8aa34cdebe0e90a40f3fae793b8f3253dc2bd536de85cf5f8d5299dfa00","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a873c8aa34cdebe0e90a40f3fae793b8f3253dc2bd536de85cf5f8d5299dfa00']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a491dbea-2270-5263-8cf2-b31754caddb5","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"aa15b0ae4d1e4ab57ee78a0545b59ba04fe2959f8a4d9f2bf9ca667754515297","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'aa15b0ae4d1e4ab57ee78a0545b59ba04fe2959f8a4d9f2bf9ca667754515297']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e1ee389-ced9-55ec-9ead-653b4d5f5562","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"b4fc478b6c4699d52f42c382ce665e61d093fbef964a9e448aee5ca95ed261af","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'b4fc478b6c4699d52f42c382ce665e61d093fbef964a9e448aee5ca95ed261af']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--845fc3dc-16e3-58bc-9589-3519360eb17a","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"c35594d42f7a5d5d2895164147ee1bc62bb8e294c8468093b7d6fcaab0b174c8","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c35594d42f7a5d5d2895164147ee1bc62bb8e294c8468093b7d6fcaab0b174c8']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--731083bb-d079-5282-8374-4ff4b47bab31","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"c43fd026f99bb4b767e17a2ddb55d7e2841129268d0afa1f99bd85574d26851c","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c43fd026f99bb4b767e17a2ddb55d7e2841129268d0afa1f99bd85574d26851c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2999ae14-42ef-5add-a01c-de6f8e129022","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"cf736497e4958f4392a38f686d85d004b473a34118579645b62db5647959822d","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'cf736497e4958f4392a38f686d85d004b473a34118579645b62db5647959822d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0ba4225-14ca-55db-aa16-37c313d3b05a","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"d83a3896b808a865204359191363246fa4508d95ffb4f1f1b56446e6bd8f2ded","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd83a3896b808a865204359191363246fa4508d95ffb4f1f1b56446e6bd8f2ded']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a336c50-669e-5429-8ac9-4571d07d2a8b","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"f48cb97ec31e9ae5b11ebee8d2053cc5f8813853b05dab5d15d88493fff398ed","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f48cb97ec31e9ae5b11ebee8d2053cc5f8813853b05dab5d15d88493fff398ed']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--caade0cc-3c53-5314-a9b3-8c466a9ca761","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"f59cb70d4db391477011593aa378ff4c59f144dcbb087ea8ad277e0001f652a1","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f59cb70d4db391477011593aa378ff4c59f144dcbb087ea8ad277e0001f652a1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7ae5d08-3a28-558b-86d2-435f3bf07a86","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"fc517a54aecc1e1e06e5d0ab902ce24bf57782cd77507327da9e04f55aad82bd","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'fc517a54aecc1e1e06e5d0ab902ce24bf57782cd77507327da9e04f55aad82bd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f186704-e4b5-5d73-96d7-f9af82bb39e7","created":"2026-05-09T11:35:00.000Z","modified":"2026-05-09T11:35:00.000Z","valid_from":"2026-05-09T11:35:00.000Z","name":"9e8aea15eff60db1060509564b0cee357491a84fe4ce7ccc34b384c67a5e805a","description":"IOC reported by @Now_on_VT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9e8aea15eff60db1060509564b0cee357491a84fe4ce7ccc34b384c67a5e805a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Now_on_VT/status/2053076426627088402"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--88e73a40-4fe0-5284-a577-3adf20a3ef46","created":"2026-05-09T11:38:00.000Z","modified":"2026-05-09T11:38:00.000Z","valid_from":"2026-05-09T11:38:00.000Z","name":"https://www.dropbox.com/scl/fi/e0d8h0qk5yxlb1g8q41r4/setting.ini?rlkey=erfcy8x6d9q21mv1bzuvhtx0d&st=2bvvz4tx&dl=1","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.dropbox.com/scl/fi/e0d8h0qk5yxlb1g8q41r4/setting.ini?rlkey=erfcy8x6d9q21mv1bzuvhtx0d&st=2bvvz4tx&dl=1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053077262497415575"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5194a07-6bc2-5f44-b97c-b0df520fd441","created":"2026-05-09T11:38:00.000Z","modified":"2026-05-09T11:38:00.000Z","valid_from":"2026-05-09T11:38:00.000Z","name":"67c2aace4b861db99e5f90ed418d0233d903e9c871b4b76a6364dabcccbe9b25","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '67c2aace4b861db99e5f90ed418d0233d903e9c871b4b76a6364dabcccbe9b25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053077262497415575"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd7fa17b-becf-5e6d-9eb5-43d5853386cb","created":"2026-05-09T11:38:00.000Z","modified":"2026-05-09T11:38:00.000Z","valid_from":"2026-05-09T11:38:00.000Z","name":"https://raw.githubusercontent.com/shantez441/EDGTy/refs/heads/main/wiask.ini","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://raw.githubusercontent.com/shantez441/EDGTy/refs/heads/main/wiask.ini']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053077262497415575"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4943f9cb-0322-5fd5-a15a-a2562585e1e4","created":"2026-05-09T12:00:00.000Z","modified":"2026-05-09T12:00:00.000Z","valid_from":"2026-05-09T12:00:00.000Z","name":"ooredodz.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ooredodz.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053082597148823611"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--714a9fa1-10cc-5bab-b645-e33310453463","created":"2026-05-09T12:00:00.000Z","modified":"2026-05-09T12:00:00.000Z","valid_from":"2026-05-09T12:00:00.000Z","name":"https://ooredodz.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ooredodz.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053082597148823611"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ded6316-4958-5bd4-b9e3-4f82cbc84c9f","created":"2026-05-09T13:01:00.000Z","modified":"2026-05-09T13:01:00.000Z","valid_from":"2026-05-09T13:01:00.000Z","name":"http://107.158.178.30","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://107.158.178.30']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2053098013212430805"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a8a8a1d-f561-5bc2-8831-f85c849c9da9","created":"2026-05-09T13:01:00.000Z","modified":"2026-05-09T13:01:00.000Z","valid_from":"2026-05-09T13:01:00.000Z","name":"107.158.178.30","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '107.158.178.30']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2053098013212430805"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a9e4d70-5e11-5552-8529-1061fc058663","created":"2026-05-09T13:01:00.000Z","modified":"2026-05-09T13:01:00.000Z","valid_from":"2026-05-09T13:01:00.000Z","name":"tzRk.store.ass0036.menloria.biz.ua","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tzRk.store.ass0036.menloria.biz.ua']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2053098010683347196"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f041b526-dd25-5032-81a7-899b20a418c1","created":"2026-05-09T13:01:00.000Z","modified":"2026-05-09T13:01:00.000Z","valid_from":"2026-05-09T13:01:00.000Z","name":"http://tzRk.store.ass0036.menloria.biz.ua","description":"IOC reported by @klawlikula on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tzRk.store.ass0036.menloria.biz.ua']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/klawlikula/status/2053098010683347196"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f979c26-7a53-563f-b07a-bb5b68300d7a","created":"2026-05-09T14:00:00.000Z","modified":"2026-05-09T14:00:00.000Z","valid_from":"2026-05-09T14:00:00.000Z","name":"f.digitalmaillane.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f.digitalmaillane.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053112788583661814"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3219ef21-7a2e-53c9-a712-284b19882f80","created":"2026-05-09T14:00:00.000Z","modified":"2026-05-09T14:00:00.000Z","valid_from":"2026-05-09T14:00:00.000Z","name":"http://f.digitalmaillane.com/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f.digitalmaillane.com/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053112788583661814"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb4e2c3f-b61a-5c6a-abb9-cc721d21a41f","created":"2026-05-09T16:00:00.000Z","modified":"2026-05-09T16:00:00.000Z","valid_from":"2026-05-09T16:00:00.000Z","name":"hctcc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hctcc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053143003586240963"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0f35acf-0c36-5007-b924-003e9085e656","created":"2026-05-09T16:00:00.000Z","modified":"2026-05-09T16:00:00.000Z","valid_from":"2026-05-09T16:00:00.000Z","name":"https://hctcc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hctcc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053143003586240963"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb1c282f-3ac5-5894-9379-072bae313ea8","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ea20ed1-ac00-5db6-9844-1025f0c09b4f","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--55c45574-8e6e-58dc-aecd-52d568555ffa","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"api.slime-protect.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.slime-protect.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b59dad4-5ade-5e29-8355-169fdef5b02a","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://api.slime-protect.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.slime-protect.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8462574-8682-5226-8b04-2f01c581fd01","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"ciclilazzaretti.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ciclilazzaretti.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b2a265b-e10c-5f24-9c3e-9bb975a6e16a","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://ciclilazzaretti.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ciclilazzaretti.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b074b6c1-6759-5b9f-9f6b-dba23a799be7","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"logto-admin-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'logto-admin-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--298419f6-11f2-58b9-bb6e-64af9445714d","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://logto-admin-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://logto-admin-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7d4a0fc-5681-518b-a7e5-ee42cccd7248","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"logto-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'logto-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b3d3d28-3a6e-5547-85a0-790617104e30","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://logto-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://logto-lcgggscck4oocwg884ko4sok.185.99.255.17.sslip.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--31da5429-baf1-5d36-bd41-cb6af7fcc535","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"slime-protect.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'slime-protect.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3b43a44-671d-5dfa-935e-db0d11841be7","created":"2026-05-09T16:35:00.000Z","modified":"2026-05-09T16:35:00.000Z","valid_from":"2026-05-09T16:35:00.000Z","name":"http://slime-protect.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://slime-protect.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053151871930384813"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbdfcec2-c9d4-5b56-b79d-205017736ba5","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"sreedevz.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sreedevz.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053173174611693695"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b2764f-a2f2-5160-b2bc-504fba3d5e7d","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"https://sreedevz.github.io/Netflix-Clone/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sreedevz.github.io/Netflix-Clone/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053173174611693695"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5629ba9d-9445-5a13-b45e-2ffbc26f77b4","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"naterqn.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'naterqn.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053173170128253289"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b80b6437-e3f9-5574-904d-8839aa702523","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"http://naterqn.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://naterqn.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053173170128253289"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053173170128253289"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-09T18:00:00.000Z","modified":"2026-05-09T18:00:00.000Z","valid_from":"2026-05-09T18:00:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053173170128253289"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31b9cb12-76d0-5380-8c60-9c7755d9aa38","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"http://138.124.126.97/rabot","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://138.124.126.97/rabot']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--55aabc3b-192a-5687-9dd3-5cdfd8d0b390","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"http://62.164.177.240:443/fakeurl.htm","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://62.164.177.240:443/fakeurl.htm']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--63aee7f4-de9d-5c6f-9fdf-086c159167ee","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"http://62.164.177.240/fakeurl.htm","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://62.164.177.240/fakeurl.htm']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3dcc117b-8cc2-522c-ac0a-09f7bddd5f7f","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"138.124.126.97","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '138.124.126.97']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e844e853-d455-50d8-b767-2cf511230235","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"62.164.177.240","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '62.164.177.240']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e523d938-1078-5371-910c-18d47bf95c26","created":"2026-05-09T18:20:00.000Z","modified":"2026-05-09T18:20:00.000Z","valid_from":"2026-05-09T18:20:00.000Z","name":"4893de26be7c3014e1f48c6ad171743b30bedc9a1ad5ebdc739dad9dda87caef","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '4893de26be7c3014e1f48c6ad171743b30bedc9a1ad5ebdc739dad9dda87caef']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053178265368481944"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--661f1fc4-773a-5524-9478-ae8dc7e668bb","created":"2026-05-09T18:44:00.000Z","modified":"2026-05-09T18:44:00.000Z","valid_from":"2026-05-09T18:44:00.000Z","name":"ae409f3d835b583fd60657a894398589d3f712dcb72c85d8057fc81571d73cec","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ae409f3d835b583fd60657a894398589d3f712dcb72c85d8057fc81571d73cec']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053184303605956843"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--29cfc9b1-9f87-58d2-9687-822ed5f149a9","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"cert.smartbtc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cert.smartbtc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95820539-06c5-5425-a01a-e32b3338b420","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"http://cert.smartbtc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cert.smartbtc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2189cdff-95c1-5fc3-b3f3-74222365827b","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"aointerviews.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aointerviews.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--355d7300-6b6a-5274-8c5e-7a0542282a85","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"http://aointerviews.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aointerviews.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55478624-c168-5775-8fd6-49ba7ec67008","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"http://51.79.185.184","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://51.79.185.184']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--902e733a-d114-577b-905f-f685179e8d0a","created":"2026-05-09T19:02:00.000Z","modified":"2026-05-09T19:02:00.000Z","valid_from":"2026-05-09T19:02:00.000Z","name":"51.79.185.184","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '51.79.185.184']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053188893726437695"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f5e2f9e-7363-56f2-8770-04b422279eaa","created":"2026-05-09T19:09:00.000Z","modified":"2026-05-09T19:09:00.000Z","valid_from":"2026-05-09T19:09:00.000Z","name":"1921717197c1e6da607cf23a9f3da5f2d0e67ff7cbf6f5a82cd00b53524aa653","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '1921717197c1e6da607cf23a9f3da5f2d0e67ff7cbf6f5a82cd00b53524aa653']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053190702276722933"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--54817587-b6b5-5ccf-81a2-3e06a621b2f9","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"anthodisk.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'anthodisk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d190251c-38ce-5cc8-a9fd-940f5f5a0584","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"http://anthodisk.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://anthodisk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3fb7f96-32a0-5766-952e-90e475a54dbd","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"lipontrent.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lipontrent.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0628f6cb-01bd-55cc-987a-f9e0c7f91ddc","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"http://lipontrent.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lipontrent.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88bc3c8f-50a5-54d4-936c-b00b54c5668a","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"scrappd.ink","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'scrappd.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--289cd1fa-11f4-584a-a2a1-512732b59522","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"http://scrappd.ink","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://scrappd.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9094f80c-7988-5229-8545-b818d6ea056b","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"expmle.ink","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'expmle.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3a41657-173d-559d-b191-ba6e8d1dc9bf","created":"2026-05-09T19:19:00.000Z","modified":"2026-05-09T19:19:00.000Z","valid_from":"2026-05-09T19:19:00.000Z","name":"http://expmle.ink","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://expmle.ink']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053193136814399697"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3a1aed8-31ad-54d4-8a12-99d8d919a3ae","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"keypmenu.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'keypmenu.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c580511-7aef-58d8-b2c2-56ca906fd7f8","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://keypmenu.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://keypmenu.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e58e326-cd45-5fbf-b113-ea6bdb322ac6","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"kellystreets.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kellystreets.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d29fdb69-979c-5a94-bc7e-712ffaf9f339","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://kellystreets.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kellystreets.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c207e94-7c95-57c0-80c5-fad7e8e6f08a","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"recordstrace.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'recordstrace.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--510d4aa8-9f55-5838-81bb-ed71c2ed4e0e","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://recordstrace.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://recordstrace.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--441f99cf-3803-567f-b671-51c94824f71a","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"image-vlt.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'image-vlt.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--07b594ea-b71e-5086-b8db-5ed8415d0375","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://image-vlt.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://image-vlt.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cc722b3-b5ab-5ec8-9d0d-c0cb246d8526","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"visaphoto-vault.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'visaphoto-vault.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--81017e42-23c1-5793-864b-31fef379863a","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://visaphoto-vault.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://visaphoto-vault.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--19097971-e524-505d-a0bb-eff453390de1","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"photostore-hub.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'photostore-hub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--381d822d-050f-5729-9f85-685bcb233502","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"http://photostore-hub.info","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://photostore-hub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e235470-01bf-593a-b966-8f294f400fb7","created":"2026-05-09T19:28:00.000Z","modified":"2026-05-09T19:28:00.000Z","valid_from":"2026-05-09T19:28:00.000Z","name":"d54a6dafa3e4d332aee833d6a96f5a74f0047e37f43dac72a669d6a4a0b9820f","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd54a6dafa3e4d332aee833d6a96f5a74f0047e37f43dac72a669d6a4a0b9820f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053195535033454909"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac7da11-0aec-59bf-824a-14165b674faa","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"jpgomd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jpgomd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a970a13-5dda-54f7-9847-df1049b0dd3c","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"http://jpgomd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jpgomd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed8bf1eb-f8d3-5690-aa12-52bd70584747","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"jpgrsv.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jpgrsv.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a09cec37-fe98-502c-914c-ecb69fae95c4","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"http://jpgrsv.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jpgrsv.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a268556-8637-5ffd-9745-1274ebb04fe3","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"http://45.227.254.10/fakeurl.htm","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45.227.254.10/fakeurl.htm']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd04e70-7d1f-59f5-bed1-7d9ce5693a69","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"45.227.254.10","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.227.254.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64ea8b96-d18d-5104-9205-1a71ef82d250","created":"2026-05-09T19:29:00.000Z","modified":"2026-05-09T19:29:00.000Z","valid_from":"2026-05-09T19:29:00.000Z","name":"cb04f21f53d0cfbf576070268b8a8719","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'cb04f21f53d0cfbf576070268b8a8719']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053195790751850899"}],"labels":["NetSupport"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64105f09-c0df-5903-847c-9b622c8a5ac3","created":"2026-05-09T19:34:00.000Z","modified":"2026-05-09T19:34:00.000Z","valid_from":"2026-05-09T19:34:00.000Z","name":"a37b157d-8823-4ec3-8447-919c9b91e4e3.usrfiles.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a37b157d-8823-4ec3-8447-919c9b91e4e3.usrfiles.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197052209725443"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69003a27-b7c1-5c62-869e-4706193e5d0e","created":"2026-05-09T19:34:00.000Z","modified":"2026-05-09T19:34:00.000Z","valid_from":"2026-05-09T19:34:00.000Z","name":"http://a37b157d-8823-4ec3-8447-919c9b91e4e3.usrfiles.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a37b157d-8823-4ec3-8447-919c9b91e4e3.usrfiles.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197052209725443"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e7d50ae-a968-52e4-a356-bfa2d42d4ce5","created":"2026-05-09T19:34:00.000Z","modified":"2026-05-09T19:34:00.000Z","valid_from":"2026-05-09T19:34:00.000Z","name":"3b9d2f4b65f0943e31221ae1d937ea29d3da8b556dd6b7c4d7846444d7ba3001","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '3b9d2f4b65f0943e31221ae1d937ea29d3da8b556dd6b7c4d7846444d7ba3001']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197052209725443"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--714b56b4-0abb-5bb1-bda5-3d5b5de91211","created":"2026-05-09T19:37:00.000Z","modified":"2026-05-09T19:37:00.000Z","valid_from":"2026-05-09T19:37:00.000Z","name":"http://43.142.51.69","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.142.51.69']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197787416744393"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--773a9ded-2194-542f-bcc0-6abdab9a5c97","created":"2026-05-09T19:37:00.000Z","modified":"2026-05-09T19:37:00.000Z","valid_from":"2026-05-09T19:37:00.000Z","name":"43.142.51.69","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.142.51.69']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197787416744393"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca808bef-3c5b-5674-8add-bf50554888fe","created":"2026-05-09T19:37:00.000Z","modified":"2026-05-09T19:37:00.000Z","valid_from":"2026-05-09T19:37:00.000Z","name":"7d7948005af45b2fbc59a20c266ffd70f584d0fba1a28e048bd9994ad9353bdb","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7d7948005af45b2fbc59a20c266ffd70f584d0fba1a28e048bd9994ad9353bdb']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053197787416744393"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f455b35f-f10c-5c53-81af-3aee68a881a7","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"doc-securehub.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc-securehub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c698922e-ec51-517e-9398-a61683ffc63c","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"http://doc-securehub.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc-securehub.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a5508c4-1a89-51e5-a868-f78225aa5364","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"safe-picvault.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'safe-picvault.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9eec527-f9b9-5531-b4fd-510bf62acb1f","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"http://safe-picvault.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://safe-picvault.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bee9fbdc-734e-5600-a6e2-373985c909a3","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"safedoc-storage.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'safedoc-storage.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--43d7b318-e014-5048-9671-9b8ad6375c23","created":"2026-05-09T19:43:00.000Z","modified":"2026-05-09T19:43:00.000Z","valid_from":"2026-05-09T19:43:00.000Z","name":"http://safedoc-storage.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://safedoc-storage.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053199219540869578"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--26e6129e-5fce-5f65-b452-a823f1d6c7d0","created":"2026-05-09T20:00:00.000Z","modified":"2026-05-09T20:00:00.000Z","valid_from":"2026-05-09T20:00:00.000Z","name":"ledgr-live-s.zapier.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ledgr-live-s.zapier.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053203388720927067"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed3b725b-1dfa-5f72-93b8-8f035ca97dc4","created":"2026-05-09T20:00:00.000Z","modified":"2026-05-09T20:00:00.000Z","valid_from":"2026-05-09T20:00:00.000Z","name":"https://ledgr-live-s.zapier.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ledgr-live-s.zapier.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053203388720927067"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a0d6723-6d5c-5a6e-8eb0-9f601c2023b5","created":"2026-05-09T22:00:00.000Z","modified":"2026-05-09T22:00:00.000Z","valid_from":"2026-05-09T22:00:00.000Z","name":"mailtiscaliitupdate2026.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mailtiscaliitupdate2026.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053233598661038329"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--288099d0-80a2-5656-bbea-4391b1733f67","created":"2026-05-09T22:00:00.000Z","modified":"2026-05-09T22:00:00.000Z","valid_from":"2026-05-09T22:00:00.000Z","name":"https://mailtiscaliitupdate2026.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mailtiscaliitupdate2026.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053233598661038329"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1180c7e0-9ed0-53e2-b122-262305d07433","created":"2026-05-10T00:00:00.000Z","modified":"2026-05-10T00:00:00.000Z","valid_from":"2026-05-10T00:00:00.000Z","name":"arpitgoel889.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'arpitgoel889.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053263843992748534"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46161b1a-4124-50c4-95e9-d3a5a82485b2","created":"2026-05-10T00:00:00.000Z","modified":"2026-05-10T00:00:00.000Z","valid_from":"2026-05-10T00:00:00.000Z","name":"https://arpitgoel889.github.io/Instagram/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://arpitgoel889.github.io/Instagram/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053263843992748534"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f69418e-a80a-501a-a7dd-a661351d10c1","created":"2026-05-10T00:26:00.000Z","modified":"2026-05-10T00:26:00.000Z","valid_from":"2026-05-10T00:26:00.000Z","name":"jwluck.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jwluck.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053270441473810905"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80029f73-1408-5a3e-a2b1-add62812d7d5","created":"2026-05-10T00:26:00.000Z","modified":"2026-05-10T00:26:00.000Z","valid_from":"2026-05-10T00:26:00.000Z","name":"https://jwluck.com/newsletter/click/lxnn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jwluck.com/newsletter/click/lxnn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053270441473810905"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a28e849a-0d77-5a90-9ec8-2c48429d857a","created":"2026-05-10T00:29:00.000Z","modified":"2026-05-10T00:29:00.000Z","valid_from":"2026-05-10T00:29:00.000Z","name":"dxeebol.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dxeebol.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053271216988074255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ab5dec-7811-565c-bc8f-3807a1bc5d18","created":"2026-05-10T00:29:00.000Z","modified":"2026-05-10T00:29:00.000Z","valid_from":"2026-05-10T00:29:00.000Z","name":"https://dxeebol.com/support/rvar","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dxeebol.com/support/rvar']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053271216988074255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0b5aeb4-2587-5411-8dc9-40887d51916d","created":"2026-05-10T02:00:00.000Z","modified":"2026-05-10T02:00:00.000Z","valid_from":"2026-05-10T02:00:00.000Z","name":"facebook-authentication.secure-datalink.org","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'facebook-authentication.secure-datalink.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053294013847883935"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5b54275-4c06-5ad8-8c3b-ba150449944b","created":"2026-05-10T02:00:00.000Z","modified":"2026-05-10T02:00:00.000Z","valid_from":"2026-05-10T02:00:00.000Z","name":"https://facebook-authentication.secure-datalink.org/landing/form/ee998719-7491-477e-8934-1608a3f86cba","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://facebook-authentication.secure-datalink.org/landing/form/ee998719-7491-477e-8934-1608a3f86cba']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053294013847883935"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7bd0025a-f0d2-5825-9286-4323e4b10823","created":"2026-05-10T04:00:00.000Z","modified":"2026-05-10T04:00:00.000Z","valid_from":"2026-05-10T04:00:00.000Z","name":"defidappsrestore.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'defidappsrestore.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053324182784512110"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fd71377-e87d-58c2-abed-6600c8f86282","created":"2026-05-10T04:00:00.000Z","modified":"2026-05-10T04:00:00.000Z","valid_from":"2026-05-10T04:00:00.000Z","name":"https://defidappsrestore.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://defidappsrestore.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053324182784512110"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ca518c-06d4-5289-9462-1536a3e4041c","created":"2026-05-10T04:05:00.000Z","modified":"2026-05-10T04:05:00.000Z","valid_from":"2026-05-10T04:05:00.000Z","name":"sibillacapital.com","description":"IOC reported by @RansomwareLive on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sibillacapital.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RansomwareLive/status/2053325573666087318"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a2f9559-086f-52d0-bcaf-bbdec13cc104","created":"2026-05-10T04:05:00.000Z","modified":"2026-05-10T04:05:00.000Z","valid_from":"2026-05-10T04:05:00.000Z","name":"https://sibillacapital.com/@incranso","description":"IOC reported by @RansomwareLive on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sibillacapital.com/@incranso']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RansomwareLive/status/2053325573666087318"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e869404-5cd2-5e1f-a410-2b1289dd46c9","created":"2026-05-10T05:14:00.000Z","modified":"2026-05-10T05:14:00.000Z","valid_from":"2026-05-10T05:14:00.000Z","name":"43.160.218.110","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.160.218.110']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053342785915564042"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b986275-850e-50d7-a222-93f713ea3f58","created":"2026-05-10T06:00:00.000Z","modified":"2026-05-10T06:00:00.000Z","valid_from":"2026-05-10T06:00:00.000Z","name":"amazonbylio.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amazonbylio.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053354433459655021"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--231ca1c1-b247-5559-b69d-7b90b1f978a5","created":"2026-05-10T06:00:00.000Z","modified":"2026-05-10T06:00:00.000Z","valid_from":"2026-05-10T06:00:00.000Z","name":"https://amazonbylio.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://amazonbylio.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053354433459655021"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5685e35-22d9-5b93-97bf-b10f407e8825","created":"2026-05-10T08:00:00.000Z","modified":"2026-05-10T08:00:00.000Z","valid_from":"2026-05-10T08:00:00.000Z","name":"gmx-konto74.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmx-konto74.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053384582003642781"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97a8b137-7dbd-54a6-9670-0f62f13b0f55","created":"2026-05-10T08:00:00.000Z","modified":"2026-05-10T08:00:00.000Z","valid_from":"2026-05-10T08:00:00.000Z","name":"https://gmx-konto74.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://gmx-konto74.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053384582003642781"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a000c9de-4a89-5392-8d30-648fb1c8dc76","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44b57a02-646d-559e-b1b5-926d9bddd507","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://u28x.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u28x.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8878e283-9592-54c6-83f1-67c02d0c3f5d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--007168d9-c1e7-5de1-a278-5769e5cccf32","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://z63k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://z63k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9be099e-2b70-5862-b6c4-c88f27dea486","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc875c71-b3bc-515a-9ac7-37111eefc8a7","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://r45x.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r45x.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fbbe286-2b12-5129-9af5-f47579400799","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f20f068d-bb9b-5c23-ba40-85d50d49b12a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://a86u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a86u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deb18f3e-5a69-5fde-b580-48c52f3309f6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b92f1e5-f6f0-5375-b07c-d4d08a322be9","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g47t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g47t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cf4d52-acd5-5ae5-aac1-f301d6d45a8e","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1e5dc6e-c094-5b24-9a39-553fce2072d4","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://t34d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t34d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b14f156-37b8-5031-8c09-60235ebad290","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84ca451f-8a86-5fc5-9747-f5173647fb3f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://k29h.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k29h.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0795e3ef-ac8a-5a20-a851-768ce3499068","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba0613f7-7170-5142-a8a5-3f5b337fbfc6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y28s.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y28s.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e02302-ed37-50e8-9b6a-a4eb5f9665ce","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33694624-f74a-5247-aef0-544854528f53","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j75n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j75n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4ea5e80-b434-5048-9b44-417250bfa65a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce0b0215-7b52-5a53-a6ce-0baaaf5fdcb6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j82k.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j82k.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92e967d3-4400-5f10-ab31-537d05968471","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba7527b3-e4c8-5794-b3d0-00e56f92b6db","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j69t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j69t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d92c4383-39ee-5b28-b869-dc3f792ea4ef","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d219f4d2-9364-5d40-9902-52a6f9f5b08f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j56y.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b99a2089-aafc-5ad0-a87b-c56116e89620","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3287317-0816-50c6-851c-daeed976f724","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://r47b.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://r47b.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd933e21-d642-54f7-9f84-44ba1ab0f33f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516a6c73-94dd-5bd4-aa17-a69b82749b50","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://p78t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p78t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d12fb16d-bea5-5a58-9ef3-902bcb81f9c3","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55eedca5-76d5-5ad8-8018-52eba0a1b264","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j56y.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j56y.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a91f80cf-0a45-5845-817c-2ac9acd02f94","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a972f110-f025-5a6d-b505-d1f2b6139da9","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v52e.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v52e.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1df3e60a-3000-54ad-b8fd-66f5b4bf245a","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d84c6ea2-7c81-5f64-ab29-2bcf1f114362","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://n58k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n58k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f981f00c-c319-5daa-b76c-d321d6be14ff","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d7d1d15-187c-5795-8f29-006d01c773d7","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://j28t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://j28t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94d22e37-22d2-5604-b836-5c948c1946c1","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30fc5647-d002-544f-96f1-a099c2e1c51b","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v22a.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v22a.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--820a90a2-91e4-5eea-865b-69791f622533","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aaad6be-2e40-528f-987d-306d06dfe4b2","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y12p.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y12p.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--024f342b-c695-54a3-9a2a-35e8a992dce0","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15ad7ec-3e94-5798-b19b-818548564fe4","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://v42t.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://v42t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc55e36b-f358-5374-a503-10ef8c375b3d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd8de9b6-1e4e-5309-b7c3-744d97874f65","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y66u.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y66u.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbe0e4a4-0fcf-5521-9188-b117b59bb55d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0833a69-4447-5128-859f-4dbee1693b2b","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://s44n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://s44n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76055abe-54c1-5d47-8fa2-2398ccc1c4c0","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1f76885-64b0-5941-ba21-18251cc058ac","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://u84k.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://u84k.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a890e500-89d8-5ec4-b938-0bedb264631f","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12d658bd-4f12-50ef-83f0-5d34c2d13221","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g86d.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g86d.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e246d41-a2ac-5aef-9a9f-a8392f5a4837","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--51fe5ebb-e971-5848-b0f7-3f64713e365d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://y29v.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://y29v.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f065b5de-ee47-59f7-bd12-aa9142eee523","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552c7c07-132f-513d-86ba-838b72eb4758","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://b47t.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://b47t.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53934beb-8fbc-5c6c-847d-6d37fdf89378","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f76be1e-d34e-5549-b000-f977f2c3d3ab","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://t45r.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t45r.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27a7e541-0793-57cd-acb5-1f217aaa89a6","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--672aeb71-36e6-5a3a-bd96-7095da9bbb7d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://g83u.site","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://g83u.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d6ca7a1-99db-5755-89fc-dbfc6420ba69","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e766c30-afb4-5431-a80b-ffb2f85e028d","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://f28n.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://f28n.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5bd4bc5-d8ae-5403-aabf-bd14a60bf126","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"http://67.209.179.189","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://67.209.179.189']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcbe0ac0-b5e1-5906-9248-637acec476fe","created":"2026-05-10T08:10:00.000Z","modified":"2026-05-10T08:10:00.000Z","valid_from":"2026-05-10T08:10:00.000Z","name":"67.209.179.189","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '67.209.179.189']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053387289636536712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7951f66-0667-5231-944d-77366f0a9e62","created":"2026-05-10T08:40:00.000Z","modified":"2026-05-10T08:40:00.000Z","valid_from":"2026-05-10T08:40:00.000Z","name":"31.3.218.73","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '31.3.218.73']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053394653836427316"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dfbe2c6-b871-5bb3-b358-832db7177fdc","created":"2026-05-10T09:28:00.000Z","modified":"2026-05-10T09:28:00.000Z","valid_from":"2026-05-10T09:28:00.000Z","name":"c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c283d62a0b3a8b073dc436c71611f6d1ecb324b70a4f1c5cd46ec9b4beccd02e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053406821767848397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--945b5c33-448f-5675-bcd8-157edc2d9950","created":"2026-05-10T09:41:00.000Z","modified":"2026-05-10T09:41:00.000Z","valid_from":"2026-05-10T09:41:00.000Z","name":"mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2053410126988710029"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb6cb666-faad-5f1c-b69f-b59bc60f2c0c","created":"2026-05-10T09:41:00.000Z","modified":"2026-05-10T09:41:00.000Z","valid_from":"2026-05-10T09:41:00.000Z","name":"https://mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion","description":"IOC reported by @fbgwls245 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mes4qo4rd6t3biyrm6q4twkquspzd7r4kg7va765nbdfxqgnc2w3pead.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fbgwls245/status/2053410126988710029"}],"labels":["ransomware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b7bfb83-696e-529b-ad0b-5026fe1635d5","created":"2026-05-10T10:00:00.000Z","modified":"2026-05-10T10:00:00.000Z","valid_from":"2026-05-10T10:00:00.000Z","name":"roblox.com.ge","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'roblox.com.ge']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053414763573502092"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--829e2c12-962b-55f6-8600-9894ce5ceed1","created":"2026-05-10T10:00:00.000Z","modified":"2026-05-10T10:00:00.000Z","valid_from":"2026-05-10T10:00:00.000Z","name":"https://roblox.com.ge/communities/5040898348/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://roblox.com.ge/communities/5040898348/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053414763573502092"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3293cfd-c7e7-5f5b-884b-86c89d9b7986","created":"2026-05-10T10:36:00.000Z","modified":"2026-05-10T10:36:00.000Z","valid_from":"2026-05-10T10:36:00.000Z","name":"178.105.102.230","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '178.105.102.230']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053423935656775950"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abe4515e-8825-5853-ae9b-289e965a0c8b","created":"2026-05-10T12:00:00.000Z","modified":"2026-05-10T12:00:00.000Z","valid_from":"2026-05-10T12:00:00.000Z","name":"vasudevrameshjangid.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vasudevrameshjangid.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053444986192998828"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f60d376a-fe2e-5c50-af76-958eb9b70453","created":"2026-05-10T12:00:00.000Z","modified":"2026-05-10T12:00:00.000Z","valid_from":"2026-05-10T12:00:00.000Z","name":"https://vasudevrameshjangid.github.io/clonenetbyvasu","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://vasudevrameshjangid.github.io/clonenetbyvasu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053444986192998828"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba8d3d39-3420-54ee-9848-417e55fecfe3","created":"2026-05-10T14:00:00.000Z","modified":"2026-05-10T14:00:00.000Z","valid_from":"2026-05-10T14:00:00.000Z","name":"cloud-a34c2.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cloud-a34c2.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053475184879780230"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38ce0a24-db7e-586f-ac1f-3972dde9eca7","created":"2026-05-10T14:00:00.000Z","modified":"2026-05-10T14:00:00.000Z","valid_from":"2026-05-10T14:00:00.000Z","name":"https://cloud-a34c2.web.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cloud-a34c2.web.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053475184879780230"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd6f7d26-35ae-573a-8d5b-84c690f239c2","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"dcqxqqx.dumzv.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dcqxqqx.dumzv.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--983be40b-8093-52b1-acc9-e2849a18f2bf","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://dcqxqqx.dumzv.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dcqxqqx.dumzv.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1b6f075-1e86-54c2-a0c0-dc776910bea8","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"meekys.mtffx.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'meekys.mtffx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8dcff19-9c8a-5d1f-8a33-2620747f3b3a","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://meekys.mtffx.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://meekys.mtffx.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9a75741-e2a3-5729-8f80-5485d105ca40","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"zamknj.xagnnx.cn","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zamknj.xagnnx.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15b42b24-f15f-56ac-a4b3-fdf01ae08d91","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"https://zamknj.xagnnx.cn/gpajp/accunt/lginox/","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zamknj.xagnnx.cn/gpajp/accunt/lginox/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-10T14:58:00.000Z","modified":"2026-05-10T14:58:00.000Z","valid_from":"2026-05-10T14:58:00.000Z","name":"165.154.231.146","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053489748489216001"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65ddd178-752d-52b2-bb23-35545a97df57","created":"2026-05-10T15:05:00.000Z","modified":"2026-05-10T15:05:00.000Z","valid_from":"2026-05-10T15:05:00.000Z","name":"n9.cl","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n9.cl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053491618225979711"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20583637-0e44-5fa1-9e0c-c1842d31290c","created":"2026-05-10T15:05:00.000Z","modified":"2026-05-10T15:05:00.000Z","valid_from":"2026-05-10T15:05:00.000Z","name":"https://n9.cl/tuhgeg","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://n9.cl/tuhgeg']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053491618225979711"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffc92d68-c3de-5f44-842a-7c65102280a9","created":"2026-05-10T16:00:00.000Z","modified":"2026-05-10T16:00:00.000Z","valid_from":"2026-05-10T16:00:00.000Z","name":"portal-kucoin-login-info.typedream.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'portal-kucoin-login-info.typedream.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053505409034449333"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e44990e-69a4-54e6-8659-e003c66c0b0d","created":"2026-05-10T16:00:00.000Z","modified":"2026-05-10T16:00:00.000Z","valid_from":"2026-05-10T16:00:00.000Z","name":"https://portal-kucoin-login-info.typedream.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://portal-kucoin-login-info.typedream.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053505409034449333"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c447df66-e196-5b85-afc5-35918f54ecfe","created":"2026-05-10T16:44:00.000Z","modified":"2026-05-10T16:44:00.000Z","valid_from":"2026-05-10T16:44:00.000Z","name":"193.169.240.81","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '193.169.240.81']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053516490687778916"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f108588f-ee80-5ed1-b3cb-e543a2808261","created":"2026-05-10T16:58:00.000Z","modified":"2026-05-10T16:58:00.000Z","valid_from":"2026-05-10T16:58:00.000Z","name":"ghostupdate.duckdns.org","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ghostupdate.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053520109134573579"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e15de357-c849-53fd-95c7-dc21af4214e1","created":"2026-05-10T16:58:00.000Z","modified":"2026-05-10T16:58:00.000Z","valid_from":"2026-05-10T16:58:00.000Z","name":"http://ghostupdate.duckdns.org","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ghostupdate.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053520109134573579"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d44f449-610b-504f-ae98-78de21ad3ef9","created":"2026-05-10T17:15:00.000Z","modified":"2026-05-10T17:15:00.000Z","valid_from":"2026-05-10T17:15:00.000Z","name":"798ed7dd5b733b82b05df7fe9f6f546f","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '798ed7dd5b733b82b05df7fe9f6f546f']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2053524302776132078"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2f02c70-5ab4-54ad-94c5-0912cfa55513","created":"2026-05-10T17:34:00.000Z","modified":"2026-05-10T17:34:00.000Z","valid_from":"2026-05-10T17:34:00.000Z","name":"dd03408b67f24d61832ab48fc5e41f11","description":"IOC reported by @ReBensk on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'dd03408b67f24d61832ab48fc5e41f11']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ReBensk/status/2053529232308117755"}],"labels":["Android","Trojan","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac74542c-c8a4-52c0-81ca-d5493e1dcb65","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"k1dash.treeslinks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'k1dash.treeslinks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb96cdf2-b035-575f-9575-ac93e5dfff20","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://k1dash.treeslinks.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://k1dash.treeslinks.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ff6a9d-88c1-56df-b0b4-97edc7d62183","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs5send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs5send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82113f98-4111-5b69-8613-09df17007eca","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs5send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs5send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81239bb3-2918-5d8e-ac7b-7a510def6d38","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs5link.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs5link.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43f3402b-fd6e-5610-8292-dc475cd9f083","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs5link.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs5link.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68b2c657-11a0-5bc7-9473-d853ffb28abc","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs8send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs8send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--697e0a7a-d5aa-570e-a162-17ce2254c670","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs8send.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs8send.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--634714e2-e431-507d-ad6b-de2d03be7fd6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec3f427-969c-5bc0-b7fa-81363ac779aa","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f97c4395-8e35-53c5-8d26-383395f97989","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"kakao.com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kakao.com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ada154d4-4e92-5429-b076-60f32abc78f8","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://kakao.com-account.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kakao.com-account.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b37e66c-ebe1-58a8-87b0-046e104bc76c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--648ab9d7-50be-534b-8708-38e6843214d9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771e33c8-080a-572c-8eaf-c1ee9603c310","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"kakao.com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kakao.com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1955d6ec-39e4-5eab-99a5-d621fc604828","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://kakao.com-login.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kakao.com-login.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60a40414-fd34-5677-8662-4dd1d8366ee6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"aldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b829a3e7-0858-5c94-9c84-78dafbfdfe9d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://aldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e73ddf2-9d55-59fd-8cc2-b1d8f54e6170","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ndocs-asend.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs-asend.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2eb59ae-11f8-5e4b-93c1-4351a4bf2d67","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ndocs-asend.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs-asend.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ccf0fb85-c16e-5f07-bc97-c7753b0612f4","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"atdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'atdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d671352-f6e4-5f18-8278-e047496b2c3c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://atdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://atdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3de41863-b12a-5de1-a681-57a67982742b","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"akdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'akdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46789540-e67b-5f4e-b2c5-fe5964f8a0cf","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://akdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://akdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65346ca0-62a4-5098-b5ae-5335f2f6d413","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"amdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63f60dd2-f2cb-5d30-8758-7e9b703c2bd3","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://amdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://amdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9aee9a8-4729-56ac-bebf-afa895170138","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"aodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'aodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ecd247a-967e-594e-9507-e35013d912ac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://aodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://aodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--810949ca-be59-5547-af36-acd870178e44","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ledocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ledocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d87fddf6-2b61-54bf-9d86-43c9118e338a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ledocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ledocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24999251-fb97-5a90-9613-c50d7c57d8ae","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b496403-8005-5677-bb78-80e0134756fb","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0676b36e-aa24-51d1-b00d-2a5e4046a464","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lidocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lidocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c767a8cd-a757-5beb-8c61-91eed197e2b9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lidocument-hometax.wjg.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lidocument-hometax.wjg.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c2568ed-cb8c-59aa-b4aa-fd7f84adb83a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31ad925b-7914-5d65-912d-50328b053c63","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8223145c-b072-574a-a935-60c901f91f25","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2064cadc-f913-51e3-8651-a52645f1e4d4","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3122ec76-98b0-5b00-ab9e-324b108218c7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"lmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc58a33c-d535-5c1c-9dc3-9e6b46b2e5e5","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://lmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed5f7fa9-0598-56d2-994b-989a07e8b8ac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25d0b53a-97fe-54e6-9f78-357ffc2a167d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nndocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nndocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca11f41b-0ae4-5ec6-a003-11ce8382dd64","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6bfb91b1-3d72-50bc-be23-7f14ebaa239c","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nldocument-home.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nldocument-home.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f5816b5-ec89-5527-b910-f2aac81b4cd6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"ntdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04ebdf31-a282-5627-a349-c02822d55e77","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://ntdocument-hometax.mydns.jp","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdocument-hometax.mydns.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5da4d0-2597-5e91-954b-20fa0645efea","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nidocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75c00ce8-052a-5b49-9fcc-6bf2e5ed3b5d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nidocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fa0b423-3eea-56c1-882c-ca62b77d51ba","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cbd7dab1-1854-5cb2-b656-4bdb5116ab77","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--992ed6e8-e42a-5bd7-a82e-9a605bfe1168","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"an.nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'an.nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77a15621-906c-5cb4-a931-08b8fcab7b08","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://an.nwdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://an.nwdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19ae2d01-561e-5a9b-aa74-98fb781313d7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5af23202-41f1-58f9-8587-0564b535c789","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c61ada2-7470-5391-874f-4fa81d0dfd5d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0976ba05-24a0-53d4-9399-bd48a1d727cf","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nodocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nodocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10465233-5f31-592b-b2f7-b5ded746badc","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"nmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f631854d-f0dd-5fc6-8bd3-0e885df6cb79","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://nmdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c958ece8-42cd-5b0e-a2eb-487a746ddc35","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mpdocument-home.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mpdocument-home.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8821557a-eb2a-5f53-aa1b-db1d34c28ad6","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mpdocument-home.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mpdocument-home.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56c43b7e-7ae4-5e43-8aa3-893b4e7c664b","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"medocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'medocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4e688b4-d62a-5725-a46a-09e525092fa9","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://medocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://medocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6c3e145-fff0-527d-9978-02d73204e355","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mtdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mtdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f65793d-3cfb-532d-b662-23982f7fceac","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mtdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mtdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c53eb897-02a4-598d-b8bd-01fd5eda6e4d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"midocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'midocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f93a1f6-4d94-590d-91b8-5c7aa88fdf7f","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://midocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://midocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0430479b-daa1-5c20-b9ac-29aca5ed0801","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"mkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2774a9b2-ad88-598b-b7ee-5547c3c1db3d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://mkdocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mkdocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0dc332b-8fe5-58a2-9efb-c2d3ff9de2f3","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0001221b-c96d-58c5-9f3f-858211e1e81a","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8f01a3-8459-5794-b4ff-1fd7e4287d88","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"dn.modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dn.modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b1c2be4-ecf9-58dc-9428-4e6a2263212e","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://dn.modocument-hometax.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dn.modocument-hometax.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--004a1c72-3ec0-5a25-ada9-f0363ecbe69d","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"http://27.102.138.146","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.138.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e61b34b-092e-551e-8efb-423ac19f6ed7","created":"2026-05-10T17:35:00.000Z","modified":"2026-05-10T17:35:00.000Z","valid_from":"2026-05-10T17:35:00.000Z","name":"27.102.138.146","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.138.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053529359244271800"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a46a0d9-d726-5291-aa36-ad8fe4fa70ee","created":"2026-05-10T17:49:00.000Z","modified":"2026-05-10T17:49:00.000Z","valid_from":"2026-05-10T17:49:00.000Z","name":"docusign-signing-evelope65792.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docusign-signing-evelope65792.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053532840361402397"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1693d352-1c00-50d4-9199-7cef8e5b70f3","created":"2026-05-10T17:49:00.000Z","modified":"2026-05-10T17:49:00.000Z","valid_from":"2026-05-10T17:49:00.000Z","name":"http://docusign-signing-evelope65792.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docusign-signing-evelope65792.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053532840361402397"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0741263-eed8-57f0-b60c-0211778d9722","created":"2026-05-10T17:51:00.000Z","modified":"2026-05-10T17:51:00.000Z","valid_from":"2026-05-10T17:51:00.000Z","name":"goattechnologies.co","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'goattechnologies.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053533407791997401"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33f3b0f6-f0d5-5459-9b47-a2b7a17f74dc","created":"2026-05-10T17:51:00.000Z","modified":"2026-05-10T17:51:00.000Z","valid_from":"2026-05-10T17:51:00.000Z","name":"http://goattechnologies.co/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2).html","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://goattechnologies.co/wp-admin/js/DDDDD55666244hh4y4888111rfdr74gggghdd22122111usignnewcoded231view231%20(2).html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053533407791997401"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f8ed862-a020-5129-a9b7-99339a121f5a","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"apptechnology.xyz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apptechnology.xyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b5af872-a0d6-5f20-9299-dc9401c40677","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"http://apptechnology.xyz/bluene-upload/approved-028484-downloads.html","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://apptechnology.xyz/bluene-upload/approved-028484-downloads.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad468974-f2a1-55db-a311-52826d5407b3","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"accobymlrands.vu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'accobymlrands.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--459c2db8-4bc6-5410-ae09-d82f0138f9b1","created":"2026-05-10T18:01:00.000Z","modified":"2026-05-10T18:01:00.000Z","valid_from":"2026-05-10T18:01:00.000Z","name":"http://accobymlrands.vu","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://accobymlrands.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053535846674862439"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f67daf0a-9e30-5a0e-9f87-706d870c3e41","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"volorecoverydocuments.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'volorecoverydocuments.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca0604d9-e176-56d6-b12d-837c8b69bdfe","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"http://volorecoverydocuments.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://volorecoverydocuments.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0123834d-288f-5556-9e75-baddf0dd2526","created":"2026-05-10T18:16:00.000Z","modified":"2026-05-10T18:16:00.000Z","valid_from":"2026-05-10T18:16:00.000Z","name":"961528b48b761f9f207978bc7ebac024","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '961528b48b761f9f207978bc7ebac024']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053539599935263161"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--41d3c5e3-4b17-5489-984c-b6825903f5eb","created":"2026-05-10T18:50:00.000Z","modified":"2026-05-10T18:50:00.000Z","valid_from":"2026-05-10T18:50:00.000Z","name":"7bebc4b248402dbf988b92eb7d9c86797bb302b983e63ce0d2dba96f0f8a345a","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7bebc4b248402dbf988b92eb7d9c86797bb302b983e63ce0d2dba96f0f8a345a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2053548124132581622"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1a91431-9256-5a27-b75b-38db5357551b","created":"2026-05-10T18:50:00.000Z","modified":"2026-05-10T18:50:00.000Z","valid_from":"2026-05-10T18:50:00.000Z","name":"c38c79fe170c54976c634f50e2a7ca090719366eabad58ec2011c18775c3366d","description":"IOC reported by @BlinkzSec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c38c79fe170c54976c634f50e2a7ca090719366eabad58ec2011c18775c3366d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/BlinkzSec/status/2053548124132581622"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b12989b3-ea97-5124-93a9-f6c8dc4ba09e","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"medellin2026.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'medellin2026.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b54c4d4-9aef-527e-9570-eb75ec139535","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"http://medellin2026.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://medellin2026.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5060d10-49e1-5541-8086-cb0b0ebfb710","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"http://46.246.82.6","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://46.246.82.6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1faffe32-81d5-544c-9fdd-60fe212f2ec3","created":"2026-05-10T21:23:00.000Z","modified":"2026-05-10T21:23:00.000Z","valid_from":"2026-05-10T21:23:00.000Z","name":"46.246.82.6","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '46.246.82.6']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053586756302213195"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49cc0425-ef18-52e2-b95a-b8be3f69f85b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9576de29-bc4c-5549-b3e6-66bbb3e6771a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4e72b08-a140-57f9-a1bb-29a9a1b00475","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--038bab13-eac0-5ff0-ae09-2f9c3c4d2879","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc07affc-d597-51de-aef7-415b7a2ca76c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--857ea4e2-24c0-58ba-b944-954e5fd6d823","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpcontacts.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fdb0b77-155d-5134-94ca-f2cea89e922c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90110475-e7ae-5f3a-b8e4-73e6034bf3fd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpanel.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--423b0a5f-39e1-5ff9-ae13-f99c6cfc07d2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fa91843-dbe4-5feb-9416-453c5feeb097","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://autodiscover.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4a79fd8-2811-5c33-a8b1-6c053afccb88","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc49191-a397-5c3f-badc-11b907ad0334","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cpcalendars.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5324a746-f405-58df-b11d-75fdc777826d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53186467-b84a-55e5-81bd-bcb8666954ad","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://webdisk.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae303986-2dee-5002-a055-713ae46d0e45","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc8afd1-d530-55b8-91c3-711ef4b22984","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://webmail.xn--jj0bm3ks5m0ud95l6mlbqa.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7b40b10-2147-5a6c-9a55-4600a4235c1a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"qeing.qooglegle.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qeing.qooglegle.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--812ec12c-38b9-5356-8fd5-e2fcd524e7db","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://qeing.qooglegle.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qeing.qooglegle.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c86c3943-98c1-514d-b07d-f727480e9512","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"mail.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--198580bb-00b7-5fd8-8174-2e7597fecea7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://mail.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mail.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d03675d7-cb85-5400-abbd-bab1c2251b06","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f799fed0-370d-5fac-98a9-a73eefe31786","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a44ad71d-cda0-5176-b84e-50a3933c0874","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrcorps.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrcorps.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aab1018-4900-50fb-9e31-b00447ed237f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrcorps.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrcorps.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acb70d05-c83d-5e59-80f7-54f508b30120","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b926697-5656-55e7-98a8-f7bc4edf6148","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b79f499-13c5-5947-a6b4-9741b6970188","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.severalrule.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.severalrule.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e87472f0-0861-5db1-8c9d-c3e4b123e25e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.severalrule.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.severalrule.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f32a1d87-e7ab-5957-acaa-fdeb79fa8371","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.combookmark.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.combookmark.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dceeeccf-3386-5532-961c-ddced021e1e5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.combookmark.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.combookmark.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d3262d7-b3e1-5564-b734-669ee61215ab","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"global.homeandroid.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'global.homeandroid.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5e8cd38-0757-5183-844f-78571fc08bef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://global.homeandroid.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://global.homeandroid.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f88b4e8-5f68-5c63-8499-0ca8fb25b62a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"view.checkoptionview.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'view.checkoptionview.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--911a73ed-597b-590a-95b1-5966ec03a87d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://view.checkoptionview.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://view.checkoptionview.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0383bff4-5cc9-5c06-b582-e0da0d6ee2ec","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"size.accountverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'size.accountverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8769152f-f74c-5d2a-8e93-76993ca5d50b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://size.accountverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://size.accountverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1eea58c-a35b-57dd-980f-472e2c25e381","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"retry.globalpayment.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'retry.globalpayment.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d3d4c3-df0d-50d4-b494-aef814efd654","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://retry.globalpayment.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://retry.globalpayment.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b7ecaff-f604-56cc-975a-3e3d5357809a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.onelinesvcads.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.onelinesvcads.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23c8a751-5e57-5a41-b230-19a921e8e347","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.onelinesvcads.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.onelinesvcads.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--476c6cf3-82e9-509e-9423-723607ead180","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.usermadver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.usermadver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eebd035a-e42f-50fe-9347-17b8965c3b3b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.usermadver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.usermadver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--994120a4-08fd-561a-a428-286023f9eb71","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"node.paymentglobalserver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'node.paymentglobalserver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8a45838-f81e-5338-b314-74014255bbe7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://node.paymentglobalserver.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://node.paymentglobalserver.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b28c69a4-054a-5863-9867-37777ca72695","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.deliverymailsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.deliverymailsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--364a55a8-2e4b-545d-8eca-0f589673dddb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.deliverymailsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.deliverymailsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4522ceb7-a45a-5ea7-808c-6bbe77f66bef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"security.accountuquery.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'security.accountuquery.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f764a2a6-dd8b-5459-b25a-d0e44f631564","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://security.accountuquery.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://security.accountuquery.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04e1f677-b281-5975-84d4-03950b59a83e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.usernormalsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.usernormalsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2eae41b4-085a-5915-a88a-c81a302cecc4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.usernormalsvc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.usernormalsvc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--533842d3-5668-5a06-a2fb-d6b3ba9deb98","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.linkyoursecurity.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.linkyoursecurity.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cca79b3-7242-5232-a3d9-9c0c6ced4252","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.linkyoursecurity.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.linkyoursecurity.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d3f7593-ecc8-54d6-921d-ef11630d7667","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"loein.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'loein.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f3c2608-a74a-5340-aa44-13e722313393","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://loein.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://loein.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f00d1c4-2662-553f-bbb9-7beb744b818e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"n.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17ea99a2-cf84-5ef7-9d16-44e6f81f9484","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://n.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--846b6f70-fb38-55eb-a285-a7d94b24e3d4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"fy.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fy.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99d520e8-20bd-5a69-8b42-a1097f19edf5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://fy.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fy.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd7cfd3e-ab2f-577c-bbbe-1c1fee75d51a","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"jser.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jser.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89bf67e5-4a41-51a1-ac70-88ec6b798c17","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://jser.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jser.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--050e1baa-308b-5e40-8181-2c0e5c981a32","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.changepaymentoption.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.changepaymentoption.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d88a529c-93c8-5c29-85e4-6d0ec0dfef8f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.changepaymentoption.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.changepaymentoption.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--630e1742-cd6d-5df8-8cf3-140eac905089","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--339dfdca-d955-576c-aedd-7f7712529352","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc66e202-c81e-56c4-b664-6b26d57e31ef","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d2695aa-f68c-5bf4-a380-562727d61a75","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d66c8f5-f1c4-5f9c-a9bc-be71456e3afe","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"45chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '45chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6a041ff-f084-5629-851b-1fe81538bb69","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://45chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://45chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba91a144-d233-5b8c-acbb-bfa0c2d39c34","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"policy.usermemberauth.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'policy.usermemberauth.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c855e23b-7c11-5b36-a8fe-589fb8397103","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://policy.usermemberauth.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://policy.usermemberauth.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb155a2c-dba3-5c74-bd19-14e836eed7bd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d3707d1-f7cd-5fc9-88ea-33a38555d9d9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7dede71-97c1-5bd7-89bf-1f5d087e94d0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"service.useraccountpolicy.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'service.useraccountpolicy.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5e7870d-910c-5dd8-80e7-8e9d2fdaf6ab","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://service.useraccountpolicy.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://service.useraccountpolicy.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91f80e33-8cbf-5232-b728-6c5a08677d78","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"user.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'user.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93c3d937-f15f-5054-ae8e-4a4cfd026bb6","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://user.billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://user.billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad269d20-9ec4-530a-959b-d77076549643","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--902491a8-2657-5a4f-b996-f025e15f2b21","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://billmatedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://billmatedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3748733d-2931-5b12-8343-bcbae2e8c42e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db924131-026d-5786-9418-b4c7dba33757","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca6b6901-e92a-5fe2-a2e1-e04fbd01d869","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f27f299a-3c06-5f9d-9d7f-1ee3d0ceb092","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce84c309-642b-55d5-9218-02c6d979fbca","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25a44351-d8d0-5f03-840a-90663ea7ff90","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.authenticateudoc.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.authenticateudoc.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c87bd1-3807-523e-b8f6-4581b83fe937","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4303fee8-1117-53f7-9fd5-9856f4c46c19","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c3fa482-2f21-59b7-b14d-ccd95e22de52","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--585e864a-eb37-59b6-b8a8-b5f21f8363c9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92aa80dd-4792-5381-a41d-ca2b943bdf2b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e08e5a80-d2cc-529e-8141-cd17be21f66d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.nipsreceivedoc.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.nipsreceivedoc.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d7ab530-b965-5ae1-87f9-d8c1aeb86474","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--410f97cd-a686-500a-8a7c-7cb6c5c011ee","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ca37f5-0a24-5372-a5a7-eab62e3057f3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be9b6a63-4a8d-5ef7-b6a3-5374ba883631","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c7847dc-4e19-500f-91b6-dfc75b4f2235","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--679604c3-f3a3-5cb7-b2a5-43765adb352c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9eed81ad-8d1a-5a8c-88f8-830cea6e2a78","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3917638f-2df5-5859-a9c8-3f3d9e7d9ea9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1b8449e-2177-52b4-9399-9e6aaae67252","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f67a42e6-46ae-5152-8142-7fd33987c93c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--646770a2-3547-5535-a249-ff5b24665dd9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a270b7b4-169b-535a-ae9f-86173540ea9d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e508e0f-4979-52f5-b997-d2079d0d0b9d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d984a1d7-658c-5b76-9390-e94d0da41dd2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.supportipsinvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.supportipsinvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7082be0-1db1-501a-9d14-fdcc6e6b8fa8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6e5d2b-f36f-5b61-9427-dd7061d72b58","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e446368d-53c5-54ee-b27c-afbc73cc6c79","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85475bd6-fb59-5609-8176-ca9fd6d602d2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.uncork.biz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.uncork.biz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68ed52e3-2d40-54b2-a338-a8fb1838c5d8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ca9a935-acf5-52cd-adf7-cb0b9c1b366b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e057209-3a93-5946-9137-2e8687be55d1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"edoc.ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24ddcfe1-88fd-54da-aebe-b49f3f3d7dcb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://edoc.ipsinvoicegoji.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ipsinvoicegoji.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8110779f-e550-51da-9b04-a5fd0e6acab4","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"one.billmatedoc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'one.billmatedoc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25bd483a-e72e-53d2-b459-5350108b033c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://one.billmatedoc.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://one.billmatedoc.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--368adf70-7608-5425-b490-0e6a652afbf0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f489f2f-e5ec-58c2-896e-2466a00fe6cc","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97cf51f4-1fae-5c6b-a7a4-71a7fbe748b2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"randstring.npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'randstring.npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec8d664e-1664-5934-9393-c901c5be84da","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://randstring.npuhostvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://randstring.npuhostvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e298972-cdbf-56f1-9008-586ca9eb0b92","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"docinfo.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad0b313e-adb8-54ba-930b-9f5f6ed7b998","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://docinfo.nhistargetlink.cloud-ip.cc","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.nhistargetlink.cloud-ip.cc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2053a6b-3ecc-587c-9a92-fac5819b6cca","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b136e83-aba9-56b5-b14d-15ce4e471681","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59a22fef-ebf5-5f66-9a00-50677dca7dc5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--529a4113-d91d-520e-aad9-da4d45b83231","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86f1d16b-5366-5396-8361-54073eb19c56","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c4c74fd-4d79-589a-92e4-3e8e9da6d795","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47c12e98-6f60-5c55-a50e-801dcde2cda0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"chk.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'chk.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f736b80-69a7-5520-8066-55b8dabb4ad5","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://chk.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://chk.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58888866-45f2-5f8d-9b26-6bd51a1a6658","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2290738-0886-5e48-867f-3d8098490004","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.accessmemberuid.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.accessmemberuid.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27153e41-fcfc-5f94-abbc-e7b5bd6422a8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usr.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7506c2c-7c9c-570e-9222-b64e4d6d3c4b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usr.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b81b78f-27ee-5676-9814-7e76079489e9","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64518fc7-99fd-574a-8bb8-b3210c95b712","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--815929a4-5192-5970-b40c-55be67c6a066","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--598262cb-d12c-59a3-b8b0-0e60bde89474","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5be5a50d-eaf2-57f7-b333-15cf0cb22cdb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61059bc0-8425-5698-afb6-ed1276ab8716","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c847c52f-c167-53a7-ad6b-4f9870c9a277","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--149cc488-27c1-5b60-ad39-878ed859e9dd","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff7c7996-09ed-58d2-ac39-2cf67beaf690","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"edoc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efc1c422-8677-55a8-be82-8fa8a3836ae0","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://edoc.usrauthsystem.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.usrauthsystem.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b692c60-09b7-5825-bfb0-7bb4eaf12605","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrsessioncheck.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrsessioncheck.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5c33abc-7984-5b8c-916f-bc01db173a15","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrsessioncheck.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrsessioncheck.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c81a95c2-c524-53d5-b998-75883cb1f878","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e1c5d0b-8ba0-57b3-a698-e4d2b3f8c987","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.usrdeleteservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.usrdeleteservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc6d9ddc-386b-57da-b027-6326eee1de27","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.usercorpsetting.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.usercorpsetting.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cd40e5e-8942-5ee0-8c31-3a9a61bde3a3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.usercorpsetting.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.usercorpsetting.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--474356cc-0137-5655-9b40-600a83bea92c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b8b848c-2f9f-5e16-b160-4d382831a659","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffdaa372-df76-591c-8e0a-42a00b9dc80b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a424427e-d932-5870-b7c8-1cdf0c6efcb8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://ndocasset.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocasset.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8241135-41aa-5daf-bac3-203be48f5b37","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.okxdeliverasset.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.okxdeliverasset.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--324e2bb7-17f1-5a0c-a64e-b1facb1c75e8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.okxdeliverasset.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.okxdeliverasset.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--299cd4e0-0e23-5365-91e5-a3e63a285e72","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2351cb7-5ca3-52fd-8cda-5f042bba2086","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cef7846f-3707-5db5-86be-dfe3fc2937cb","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e937b7db-5178-5fc0-ac8a-2de9e65f4f1c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://currentdoclist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://currentdoclist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b30fa1-bd1e-5e32-bfc8-840536096391","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--95393c09-c734-5c91-bf02-e1a1d1877b59","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e6fe056-ebc1-5092-a4d9-d0532e793671","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd936531-9eb7-5d52-9e72-70e297ce81b2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.verify.nappdeliver.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.verify.nappdeliver.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2027d37-c589-5600-b7d3-4cee11ab8b89","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aac38cdc-efff-5b45-98d7-ef736dd865a2","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0f9cd43-8e97-5c15-aae4-49183235fef3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"userinfo.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'userinfo.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee842a31-9afa-5aac-b2a8-1425d870d8f1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://userinfo.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://userinfo.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3711b93b-7630-524c-9c97-4ec7de5046b3","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"invoice.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dda283d9-285a-532e-8e19-b4e1a1432c6f","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://invoice.abrs.heninvoice.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.abrs.heninvoice.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf6b32fc-1425-516a-8edf-1f95e0d9ad3d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fc15d46-d9ef-5f0f-afff-8070043be4f1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fe30588-608f-5634-b964-8009c0cffdf7","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fa49edc-9bd6-5dbe-b507-94705c68b27d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66016ec0-f448-59c2-91b4-ef679a6e5797","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"verify.docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'verify.docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--361c21ac-9aa7-5df1-b4f9-2da2f17a2409","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://verify.docempower.giize.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://verify.docempower.giize.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--153c06ad-4287-5c68-a071-05afe415527e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"info.usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'info.usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1eb98123-2bcd-52a0-89fc-9683d128dc7c","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://info.usrselectlist.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://info.usrselectlist.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--468cf673-eb61-5a2c-89b8-cdeb14502589","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"repterminvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'repterminvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2f56252-056f-5f3b-bf7a-e49ef832e1a6","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://repterminvoice.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://repterminvoice.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b57265e-d9a5-5587-9045-1224d89f518e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.siteuserverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.siteuserverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71d94339-ff34-529b-8687-c17c4605a305","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.siteuserverification.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.siteuserverification.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b33112a-f55d-5a38-9f83-41d3ed1d031b","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.userrecoveropt.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.userrecoveropt.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--73d737b3-ce27-5751-8048-bde19a514df8","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.userrecoveropt.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.userrecoveropt.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63dc74d8-5334-5c6e-87e5-2fc5005ec71d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.accountuserservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.accountuserservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3a649ee-4e59-5d1b-a3e0-a4d5ca11623d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.accountuserservice.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.accountuserservice.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ae589bb-5a3a-51fb-be9c-788e815b5442","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"login.accountverifications.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.accountverifications.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32b14ce9-7349-563b-a4f2-4c3c5847a880","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://login.accountverifications.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://login.accountverifications.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34a29d79-bf8f-5e1d-8f42-2d5638540830","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"access.userreverify.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'access.userreverify.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fd8fc40-5358-54db-afae-07dbba32e4af","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://access.userreverify.kro.kr","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://access.userreverify.kro.kr']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c5e7451-4a36-51ab-b04e-e144e004d4b1","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd4e3280-7e5e-5546-b4fe-04d3bd169362","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1131e8fb-be3e-506c-b39d-0db6a98e2424","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"doc.targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'doc.targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0644f04-26f8-5361-8af1-9452bbfa9fbe","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://doc.targetinvaddress.mydns.bz","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://doc.targetinvaddress.mydns.bz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d169baf3-c0ec-53c6-938a-77306073e49d","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"http://27.102.138.45","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.138.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1208755a-74cd-5d28-a2f5-afe51730ce2e","created":"2026-05-10T21:44:00.000Z","modified":"2026-05-10T21:44:00.000Z","valid_from":"2026-05-10T21:44:00.000Z","name":"27.102.138.45","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.138.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053592079918330349"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44435bb8-ea43-52f3-bc72-1d53264d3a9a","created":"2026-05-10T22:00:00.000Z","modified":"2026-05-10T22:00:00.000Z","valid_from":"2026-05-10T22:00:00.000Z","name":"taha1344.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'taha1344.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053595978125496548"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ea99f88-b7c1-520d-89cb-bffa7fc9091f","created":"2026-05-10T22:00:00.000Z","modified":"2026-05-10T22:00:00.000Z","valid_from":"2026-05-10T22:00:00.000Z","name":"http://taha1344.github.io/Spotify","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://taha1344.github.io/Spotify']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053595978125496548"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d47decba-f159-5428-8915-6a600dd46f78","created":"2026-05-11T00:00:00.000Z","modified":"2026-05-11T00:00:00.000Z","valid_from":"2026-05-11T00:00:00.000Z","name":"re11133.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 're11133.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053626250023837980"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27350de3-6519-5901-80e5-d1c1e7a613c9","created":"2026-05-11T00:00:00.000Z","modified":"2026-05-11T00:00:00.000Z","valid_from":"2026-05-11T00:00:00.000Z","name":"https://re11133.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://re11133.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053626250023837980"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1fa25f9-8343-5b9e-90ed-c668731f851f","created":"2026-05-11T00:17:00.000Z","modified":"2026-05-11T00:17:00.000Z","valid_from":"2026-05-11T00:17:00.000Z","name":"cqizvybx.bhmsbp.cn","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cqizvybx.bhmsbp.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053630487198126535"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfc6e74f-2b2e-52f0-881f-b1768e3cb28e","created":"2026-05-11T00:17:00.000Z","modified":"2026-05-11T00:17:00.000Z","valid_from":"2026-05-11T00:17:00.000Z","name":"https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053630487198126535"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21b7a6e1-82f8-54ad-942d-39d8f642f675","created":"2026-05-11T02:00:00.000Z","modified":"2026-05-11T02:00:00.000Z","valid_from":"2026-05-11T02:00:00.000Z","name":"135461223.site","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '135461223.site']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053656394256019686"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae9ac8f8-d9ed-5f72-b362-97fad46fd1df","created":"2026-05-11T02:00:00.000Z","modified":"2026-05-11T02:00:00.000Z","valid_from":"2026-05-11T02:00:00.000Z","name":"http://135461223.site/948/e64b5443-dfd0-47b7-9768-e62bcd731958/730140","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://135461223.site/948/e64b5443-dfd0-47b7-9768-e62bcd731958/730140']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053656394256019686"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8152397-8f6f-5bf5-8eb0-fb0169a2fd1a","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"http://130.78.217.194:8888/bot.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.78.217.194:8888/bot.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c10d0fda-06de-5483-ae97-e0d49957cc87","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"130.78.217.194","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.78.217.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c63619d-c263-55f5-a790-f451d480a92b","created":"2026-05-11T02:50:00.000Z","modified":"2026-05-11T02:50:00.000Z","valid_from":"2026-05-11T02:50:00.000Z","name":"06f55a73b369040bee42de084027d3dc","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '06f55a73b369040bee42de084027d3dc']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2053669002140938351"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--323eca74-77f1-5bbc-95b7-dcd16a3a29f0","created":"2026-05-11T04:00:00.000Z","modified":"2026-05-11T04:00:00.000Z","valid_from":"2026-05-11T04:00:00.000Z","name":"eth-login.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eth-login.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053686613176181096"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f5b541d-706c-5bb4-8e21-70106991a8e7","created":"2026-05-11T04:00:00.000Z","modified":"2026-05-11T04:00:00.000Z","valid_from":"2026-05-11T04:00:00.000Z","name":"https://eth-login.webflow.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://eth-login.webflow.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053686613176181096"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--06966599-9c7f-55fb-953d-b5777dbc782e","created":"2026-05-11T04:40:00.000Z","modified":"2026-05-11T04:40:00.000Z","valid_from":"2026-05-11T04:40:00.000Z","name":"85.239.155.68","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '85.239.155.68']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2053696616104857659"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95800f76-9b44-56ec-a150-a2c1d0c947ac","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"70.34.243.236","description":"IOC reported by @solostalking on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '70.34.243.236']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/solostalking/status/2053707334271279498"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e748b041-a8a0-5572-bd02-041ff894e1d8","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"ransomware-c2.com","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ransomware-c2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3459e6fe-a078-5cf9-8ea0-a3b5fc8bf6b3","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"http://ransomware-c2.com","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ransomware-c2.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--634eee86-0ad3-500d-893c-7d69e8e2efdc","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"ransomwarein.bio","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ransomwarein.bio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--26280804-4640-5ca0-95be-affe36b681d7","created":"2026-05-11T05:22:00.000Z","modified":"2026-05-11T05:22:00.000Z","valid_from":"2026-05-11T05:22:00.000Z","name":"http://ransomwarein.bio","description":"IOC reported by @uuallan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ransomwarein.bio']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/uuallan/status/1781666262755561930"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--164d0224-eb94-51d0-86c3-e928479f2084","created":"2026-05-11T06:00:00.000Z","modified":"2026-05-11T06:00:00.000Z","valid_from":"2026-05-11T06:00:00.000Z","name":"ayushsingh728.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ayushsingh728.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053716785858216045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7681dcf0-df9c-5028-8f83-71cab7b079e8","created":"2026-05-11T06:00:00.000Z","modified":"2026-05-11T06:00:00.000Z","valid_from":"2026-05-11T06:00:00.000Z","name":"http://ayushsingh728.github.io/Netflix-Clone","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ayushsingh728.github.io/Netflix-Clone']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053716785858216045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8655cd31-11af-5459-ab54-10c96464f4e7","created":"2026-05-11T06:25:00.000Z","modified":"2026-05-11T06:25:00.000Z","valid_from":"2026-05-11T06:25:00.000Z","name":"104.168.81.172","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.168.81.172']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053723171787035043"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--220dda2e-e30c-51ac-a796-3440bde76c78","created":"2026-05-11T06:25:00.000Z","modified":"2026-05-11T06:25:00.000Z","valid_from":"2026-05-11T06:25:00.000Z","name":"107.172.132.231","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '107.172.132.231']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053723171787035043"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c751534d-7e53-5ee1-b227-adac0aaba0a0","created":"2026-05-11T06:51:00.000Z","modified":"2026-05-11T06:51:00.000Z","valid_from":"2026-05-11T06:51:00.000Z","name":"totallyaboutweather.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'totallyaboutweather.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053729800372785348"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a6b3b91-5246-5b1f-bc37-5039c048c5c4","created":"2026-05-11T06:51:00.000Z","modified":"2026-05-11T06:51:00.000Z","valid_from":"2026-05-11T06:51:00.000Z","name":"https://totallyaboutweather.com/BpYeOhCAySak","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://totallyaboutweather.com/BpYeOhCAySak']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053729800372785348"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9d0297f-d447-52a7-a9ba-6b126a6f2c0c","created":"2026-05-11T07:28:00.000Z","modified":"2026-05-11T07:28:00.000Z","valid_from":"2026-05-11T07:28:00.000Z","name":"104.200.67.47","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '104.200.67.47']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053738879728099652"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59e52375-41a6-5995-b452-d10117e6cbf1","created":"2026-05-11T08:00:00.000Z","modified":"2026-05-11T08:00:00.000Z","valid_from":"2026-05-11T08:00:00.000Z","name":"amazonclone-steel-two.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'amazonclone-steel-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053747001083257213"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddd75d75-e458-51e0-9516-b1d500e19bb5","created":"2026-05-11T08:00:00.000Z","modified":"2026-05-11T08:00:00.000Z","valid_from":"2026-05-11T08:00:00.000Z","name":"https://amazonclone-steel-two.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://amazonclone-steel-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053747001083257213"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a50718e-9ed0-5a1c-b84f-abc629ea1f1d","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"99.83.192.149","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '99.83.192.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7488435-c1eb-5566-aa21-da11e31cfef4","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"13.248.236.92","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '13.248.236.92']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b76978b-e050-57de-a988-eaf53a74d007","created":"2026-05-11T08:31:00.000Z","modified":"2026-05-11T08:31:00.000Z","valid_from":"2026-05-11T08:31:00.000Z","name":"3eb7ddfb99097f35279e3a44fff44ff27d19389da9ba99d65ccde9716f21b91c","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '3eb7ddfb99097f35279e3a44fff44ff27d19389da9ba99d65ccde9716f21b91c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2053754734268252309"}],"labels":["C2"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7681d30-0d2e-5236-851d-59f334c0ab72","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"cloudcraftshub.com","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cloudcraftshub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--192ff736-0d8e-587a-ac94-f1cd149d3cad","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"https://cloudcraftshub.com/api","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cloudcraftshub.com/api']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e12a0bd-4f4f-5440-ac6d-9cf16221ea05","created":"2026-05-11T09:21:00.000Z","modified":"2026-05-11T09:21:00.000Z","valid_from":"2026-05-11T09:21:00.000Z","name":"f90e131ec641d1cda33800217bdf6295a0c95d8f4b2ef0406ecda78ce19685ad","description":"IOC reported by @nextronresearch on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'f90e131ec641d1cda33800217bdf6295a0c95d8f4b2ef0406ecda78ce19685ad']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/nextronresearch/status/2053767476651995310"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--67c97077-45f8-5b2c-a368-8477078218dc","created":"2026-05-11T10:00:00.000Z","modified":"2026-05-11T10:00:00.000Z","valid_from":"2026-05-11T10:00:00.000Z","name":"netflix-clone-omega-gules.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netflix-clone-omega-gules.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053777175304683701"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fcc8b3ee-0031-5a5b-806f-02125d98da0e","created":"2026-05-11T10:00:00.000Z","modified":"2026-05-11T10:00:00.000Z","valid_from":"2026-05-11T10:00:00.000Z","name":"https://netflix-clone-omega-gules.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://netflix-clone-omega-gules.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053777175304683701"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6805535f-142f-5277-9990-b68b3f4869a9","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03103b22-a257-50c8-985f-27c7d4701bb7","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d98dd74f-ab41-5c23-98d8-673339585a39","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c885738c-8d2d-5db4-814a-b7d3bf6100b0","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.sncf-connect.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.sncf-connect.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f9dcc2eb-1063-55da-b564-a1a5260d7345","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e916160d-c193-5c34-9bf9-7b12a59877c2","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2bf04f-f13a-50f1-99ef-c9c7249e25f5","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2791012-f172-53c6-87e5-13722c4bfffd","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.connect-sncf.my","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.connect-sncf.my']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--318fd33f-612f-5ba5-8c25-f8b491c6c6e4","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8971f927-c2f8-5c9d-ba2c-c6a459ccc290","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12b2aa5c-7c1e-51b1-a390-7c4de932280f","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--295cc224-7f89-53ff-ba58-cba81afd94f0","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07c7b3ea-b043-5d94-9fed-6006a648b11a","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"api.connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'api.connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62181a16-590d-57ce-a893-5b81b2ae7777","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://api.connect-sncf.me","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://api.connect-sncf.me']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b65d0383-46d6-5dad-91bf-234a04142bf1","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"connect-sncf.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'connect-sncf.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1b5c8d6-9c98-5235-8367-c8a3ac4b6ac2","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://connect-sncf.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://connect-sncf.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7130c4dc-9fb6-5790-9ca1-936929540d56","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d33e57c3-bde2-54fb-bddd-1ed570ae7dd8","created":"2026-05-11T10:33:00.000Z","modified":"2026-05-11T10:33:00.000Z","valid_from":"2026-05-11T10:33:00.000Z","name":"http://sncfconnect.cam","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sncfconnect.cam']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053785579007975442"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3faf920c-10a9-5fa5-b886-0faab94ebd31","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"online-meet.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'online-meet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d68d09c5-9ab3-50b5-8919-09ffe960341a","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"http://online-meet.com","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://online-meet.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62c6d667-4d6c-5436-bd70-3151b0dc234f","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"http://online-meet.com/files/update/uptodate.exe","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://online-meet.com/files/update/uptodate.exe']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9eb3b92-6452-5eda-83b4-270c35cc7494","created":"2026-05-11T10:39:00.000Z","modified":"2026-05-11T10:39:00.000Z","valid_from":"2026-05-11T10:39:00.000Z","name":"8a132e7dd4876c87b5c425db32291bd54a2f3a477c78ceb4d29f297867a150fa","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a132e7dd4876c87b5c425db32291bd54a2f3a477c78ceb4d29f297867a150fa']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2053787086856343986"}],"labels":["ClickFix","SalatStealer","malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--104e4db8-1aba-5e37-9d79-28ad7a3a8ce5","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"http://151.243.18.254","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://151.243.18.254']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90428b31-d8e1-5aa8-a4a6-85f0838d38e4","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"http://94.26.83.199","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://94.26.83.199']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--577f0678-d78a-5dd2-bea5-678db0d965d2","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"151.243.18.254","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '151.243.18.254']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8941e633-22d4-54ef-baec-3a11d2e52302","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"94.26.83.199","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '94.26.83.199']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbcc2264-7d1f-5d9e-a452-91ec1064db48","created":"2026-05-11T12:14:00.000Z","modified":"2026-05-11T12:14:00.000Z","valid_from":"2026-05-11T12:14:00.000Z","name":"7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb","description":"IOC reported by @cyberthint on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/cyberthint/status/2053810895281655859"}],"labels":["ClickFix"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc9ecd08-8ac5-529b-a0fa-4776c69b6c14","created":"2026-05-11T12:28:00.000Z","modified":"2026-05-11T12:28:00.000Z","valid_from":"2026-05-11T12:28:00.000Z","name":"capture10.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'capture10.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053814460901732632"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c09e1ad-b17e-5690-9486-85f2579f008f","created":"2026-05-11T12:28:00.000Z","modified":"2026-05-11T12:28:00.000Z","valid_from":"2026-05-11T12:28:00.000Z","name":"https://capture10.com/o96zJvtiS5uZ","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://capture10.com/o96zJvtiS5uZ']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2053814460901732632"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d538023b-c2e1-5b42-9cdd-15cda7e5c425","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"https://github.com/pd1-pd","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/pd1-pd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40fa8a2c-b2aa-511f-a48e-3fdd9d166b05","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"https://github.com/ud-pd","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://github.com/ud-pd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd1c9d22-c3da-5b83-810e-d23154cedf1d","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"56ff11e3d7de149ad251b6fd7e565a71","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '56ff11e3d7de149ad251b6fd7e565a71']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053822000150483047"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--772bf496-7648-5886-938c-f89fb8c2689f","created":"2026-05-11T12:58:00.000Z","modified":"2026-05-11T12:58:00.000Z","valid_from":"2026-05-11T12:58:00.000Z","name":"c196e3eedb24812568521ec9cbcedf31","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'c196e3eedb24812568521ec9cbcedf31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2051603312546594944"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a807af1d-9bca-52d8-a943-11eada56d17e","created":"2026-05-11T13:28:00.000Z","modified":"2026-05-11T13:28:00.000Z","valid_from":"2026-05-11T13:28:00.000Z","name":"74399b1d6c287ae48db67fc5e3aa5a28","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '74399b1d6c287ae48db67fc5e3aa5a28']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2053829556080144482"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6426abc3-a6f5-5926-8120-414982d699c9","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://77.110.124.112","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://77.110.124.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--15063dda-4695-5396-bf0f-1c6bc3b4e2ae","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"iuwef.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'iuwef.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--db5f35c6-c74d-5f57-b93e-ce2a60f7c85d","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://iuwef.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://iuwef.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ab560ff-caf0-5672-ba26-746316069ad0","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"koqwh.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'koqwh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--21ec6392-4d32-5e1c-94cd-d7b75789b357","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://koqwh.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://koqwh.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef4abd4-3eb3-5454-8096-daad45144d14","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"lonjfq.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lonjfq.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--680674c5-8519-54da-8e94-0926a0580dc9","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://lonjfq.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://lonjfq.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61e17b70-2c7b-5a61-baf9-16ca01945c83","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"77.110.124.112","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '77.110.124.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2053831195322904663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--647d8194-de00-53d7-b93a-d5288f02c913","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://86.54.25.202","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://86.54.25.202']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9ea5dc6-9ad9-59e7-9dba-87850cf389e0","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"http://86.54.25.204","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://86.54.25.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--69128c45-1c94-57a0-ab4b-68e34cadd9c7","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"86.54.25.202","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '86.54.25.202']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd49a93b-0f9e-5d2c-a167-7444289536da","created":"2026-05-11T13:34:00.000Z","modified":"2026-05-11T13:34:00.000Z","valid_from":"2026-05-11T13:34:00.000Z","name":"86.54.25.204","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '86.54.25.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2046290992052244803"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4158df9a-140e-52fb-9a32-ecad74ed121f","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"ndigitals.in","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndigitals.in']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4072e5d3-ae8b-5032-b6ad-d7058edcea07","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://ndigitals.in/payloadvbs.b64","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ndigitals.in/payloadvbs.b64']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1018ef49-4686-5e14-819a-ec38b27eb291","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"morrismusicltd.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'morrismusicltd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1e18e42-8629-5807-bfe1-b49cb9b0e61d","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://morrismusicltd.com/report-proeval.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://morrismusicltd.com/report-proeval.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb59374-e754-5312-aea0-28078293ec86","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"vothequine.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'vothequine.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7e3612a-ae61-5ae2-b1bb-13f493fce7ba","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://vothequine.com/sunrise.txt","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://vothequine.com/sunrise.txt']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--865c4684-c991-5106-a2df-3164bbee1c2b","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"smartheartboardgame.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'smartheartboardgame.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa7b3d9f-0b73-5878-b06b-526a4aa0d495","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://smartheartboardgame.com/report-proeval.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://smartheartboardgame.com/report-proeval.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e261828f-3db1-5eb7-b643-d3eda4b881f4","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"ristorantezago.it","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ristorantezago.it']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8d11fe9-df27-5e3f-8cda-ba5e06d4e9fe","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"https://www.ristorantezago.it/sunrise.txt","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.ristorantezago.it/sunrise.txt']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--525d01a8-c40b-5f78-a717-1ade57cf72c1","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'fcc1abd4122c4aa6f6f7722d7d3b093b95aeb84ee697239978e6201aa88cf4da']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b90dcf50-81f8-5d39-a96e-378dd0b6314b","created":"2026-05-11T13:58:00.000Z","modified":"2026-05-11T13:58:00.000Z","valid_from":"2026-05-11T13:58:00.000Z","name":"8b7d9c3085decba6895528bc26003059c779ede983e24f629c26d867f58edcb9","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8b7d9c3085decba6895528bc26003059c779ede983e24f629c26d867f58edcb9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053837248433467708"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f33b768-b834-5f58-b43b-38603342eb52","created":"2026-05-11T14:00:00.000Z","modified":"2026-05-11T14:00:00.000Z","valid_from":"2026-05-11T14:00:00.000Z","name":"onlineicloud.support","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'onlineicloud.support']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053837577736618133"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc417bc-14e4-5461-abbd-50e7b7919b59","created":"2026-05-11T14:00:00.000Z","modified":"2026-05-11T14:00:00.000Z","valid_from":"2026-05-11T14:00:00.000Z","name":"https://onlineicloud.support","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://onlineicloud.support']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053837577736618133"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e90bf08-ee99-5ab6-af3d-8a22cd319f4d","created":"2026-05-11T14:01:00.000Z","modified":"2026-05-11T14:01:00.000Z","valid_from":"2026-05-11T14:01:00.000Z","name":"http://146.103.106.59","description":"IOC reported by @RussianPanda9xx on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://146.103.106.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RussianPanda9xx/status/2053837915185111061"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7306270b-92ac-5cca-9dd5-67a1ca421f6c","created":"2026-05-11T14:01:00.000Z","modified":"2026-05-11T14:01:00.000Z","valid_from":"2026-05-11T14:01:00.000Z","name":"146.103.106.59","description":"IOC reported by @RussianPanda9xx on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '146.103.106.59']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/RussianPanda9xx/status/2053837915185111061"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2076982b-e8fd-5c89-81c7-eda2a22b6118","created":"2026-05-11T14:45:00.000Z","modified":"2026-05-11T14:45:00.000Z","valid_from":"2026-05-11T14:45:00.000Z","name":"hotel-stay32181.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hotel-stay32181.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2053848962306572344"}],"labels":["booking","phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ac0936-bc36-5772-a513-ab1d0bdfdd05","created":"2026-05-11T14:45:00.000Z","modified":"2026-05-11T14:45:00.000Z","valid_from":"2026-05-11T14:45:00.000Z","name":"https://hotel-stay32181.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hotel-stay32181.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2053848962306572344"}],"labels":["booking","phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e848bec-929c-57ae-b017-ac8d33878483","created":"2026-05-11T16:00:00.000Z","modified":"2026-05-11T16:00:00.000Z","valid_from":"2026-05-11T16:00:00.000Z","name":"briuoqrakq.firebaseapp.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'briuoqrakq.firebaseapp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053867795616579759"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--381814e7-ffba-5df5-a7e3-c62efd141774","created":"2026-05-11T16:00:00.000Z","modified":"2026-05-11T16:00:00.000Z","valid_from":"2026-05-11T16:00:00.000Z","name":"https://briuoqrakq.firebaseapp.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://briuoqrakq.firebaseapp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053867795616579759"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--126a6254-1029-51e5-9f48-10999fc2564b","created":"2026-05-11T16:21:00.000Z","modified":"2026-05-11T16:21:00.000Z","valid_from":"2026-05-11T16:21:00.000Z","name":"ins-tagram.com","description":"IOC reported by @tobersotski on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ins-tagram.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/tobersotski/status/2053873168721334344"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dfaa99e-a971-5dd5-965b-731fd0a91808","created":"2026-05-11T16:21:00.000Z","modified":"2026-05-11T16:21:00.000Z","valid_from":"2026-05-11T16:21:00.000Z","name":"http://ins-tagram.com","description":"IOC reported by @tobersotski on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ins-tagram.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/tobersotski/status/2053873168721334344"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e302f6a-0bb9-5af8-8682-41e6b7c45c1f","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"ne12bradesconetempresapj.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ne12bradesconetempresapj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9398d220-e643-550b-b8c4-674863a067a4","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"https://www.ne12bradesconetempresapj.com/acesso-seguro.php?token=1325787116a022c49017d69.66885194","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.ne12bradesconetempresapj.com/acesso-seguro.php?token=1325787116a022c49017d69.66885194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21de909c-11b8-53fc-a61b-946e6fe3615e","created":"2026-05-11T16:34:00.000Z","modified":"2026-05-11T16:34:00.000Z","valid_from":"2026-05-11T16:34:00.000Z","name":"181.214.221.46","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.46']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2053876482544488938"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be993e0-755d-5e15-948a-2f6bc25a73d6","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8116fc-e0c3-514c-b0c8-fde8be647100","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"http://mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com/com.php","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mytax-organizerad12cc52-3ef8-4c42-8474-8165bcb2c546.hendakuffventures.com/com.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15386c3c-2a68-550f-87e3-d359d4524d19","created":"2026-05-11T17:27:00.000Z","modified":"2026-05-11T17:27:00.000Z","valid_from":"2026-05-11T17:27:00.000Z","name":"b956e00320c4d41e5122a9a94d7cd03f4d5b109b64fc84ccccc777042df65738","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'b956e00320c4d41e5122a9a94d7cd03f4d5b109b64fc84ccccc777042df65738']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053889768879206643"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a434f45a-2135-5cfa-8b3b-9d7de47e84ef","created":"2026-05-11T17:46:00.000Z","modified":"2026-05-11T17:46:00.000Z","valid_from":"2026-05-11T17:46:00.000Z","name":"mcabinnesotaimplangroup.vu","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mcabinnesotaimplangroup.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053894478675783712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15988709-3672-503d-843d-96791a976da8","created":"2026-05-11T17:46:00.000Z","modified":"2026-05-11T17:46:00.000Z","valid_from":"2026-05-11T17:46:00.000Z","name":"http://mcabinnesotaimplangroup.vu","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mcabinnesotaimplangroup.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2053894478675783712"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62c195d1-058f-5ef7-a855-6f856619a2cb","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"mailnotice008.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mailnotice008.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053897976167195099"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71909647-5173-50d3-a308-0b7911184f42","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"https://mailnotice008.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mailnotice008.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053897976167195099"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe87da60-d0ea-5f9b-a09f-b9f825b07dc0","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"nid-navernet.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-navernet.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6029cd88-0125-5d18-bd27-44cd0cbf1837","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"http://nid-navernet.onthewifi.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-navernet.onthewifi.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-11T18:00:00.000Z","modified":"2026-05-11T18:00:00.000Z","valid_from":"2026-05-11T18:00:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2053897946023006597"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d2b325a-91ab-5a9b-a948-8e88ab31ce16","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"updatesubs-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'updatesubs-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24f0f36b-94f5-5b0d-8d3d-6492b7061926","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://updatesubs-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://updatesubs-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f88456e4-50dd-5ef7-94b7-923d238532ca","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"member-area-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'member-area-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e63eed89-94cc-5952-9226-e3e571db3123","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://member-area-netfilx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://member-area-netfilx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--045a5f2b-103b-58c2-8ac6-f9eac1ecd637","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-account.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-account.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c30c0357-42ca-5029-a60a-6b33f2d18adf","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-account.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-account.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9cc6de1-6a87-5016-a1ee-cce4784bf14b","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-rejoin.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-rejoin.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef0704cd-be8c-5aae-8d6e-c65ffd8f6bf9","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-rejoin.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-rejoin.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db58082f-d8d4-5d78-88b0-af87ba8d2373","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"netfilx-membership.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netfilx-membership.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7728a5f0-34a1-5cad-b9d3-d1e7f976de21","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://netfilx-membership.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://netfilx-membership.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5d1bc2-a662-5442-8d98-8906e6384347","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"my-etoll-service.vineluxe.store","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'my-etoll-service.vineluxe.store']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4698bf1-4350-537d-82e0-72909fba8925","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://my-etoll-service.vineluxe.store","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://my-etoll-service.vineluxe.store']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1220509-29d5-5865-91d4-9de0305de7f7","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"e-zpassiags-april.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-zpassiags-april.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29176ad9-816b-5a79-9130-60a2f15983ef","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://e-zpassiags-april.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e-zpassiags-april.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98329a68-420b-56d8-bad1-26dda983aeb1","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"jangenam.ooguy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jangenam.ooguy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e844af0f-5933-5df8-8111-dce496cc0405","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://jangenam.ooguy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jangenam.ooguy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7340a07-2e21-587a-bdf7-1ccb1d978c78","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpassiags-march.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpassiags-march.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1c80ef8-8c4e-56bd-884d-f03fd77463b4","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpassiags-march.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpassiags-march.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d553525-dc33-5fe0-bc02-d180a4d6b281","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-ezpass-notify.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-ezpass-notify.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24b9b70d-6767-572b-9e96-ad6da5a1e38f","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-ezpass-notify.bumbleshrimp.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-ezpass-notify.bumbleshrimp.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c279439-e6e4-5552-a7db-0321413a40d1","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-blling-ezpssiags.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-blling-ezpssiags.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adc3b6c0-64e9-58a2-908f-c09bb340850a","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-blling-ezpssiags.mysynology.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-blling-ezpssiags.mysynology.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--acae64e8-ce7d-522a-aff7-321fad129e15","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpssiags-etoll-02.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpssiags-etoll-02.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a10cb89-c86a-55f9-b0d8-b9ce7d267be7","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpssiags-etoll-02.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpssiags-etoll-02.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7b6eec9-afcf-51ad-b5f0-f34ba8262160","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"ezpssiags-bill.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ezpssiags-bill.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a31029f-bb0e-50a9-b7c4-f1f4fbb45e68","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://ezpssiags-bill.1cooldns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ezpssiags-bill.1cooldns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89b5c883-fbc8-5e06-b9e8-7d1788e799e5","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"etoll-ezpssiags.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'etoll-ezpssiags.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ac610ba-033c-5993-b6f9-7d5863b9c0c4","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://etoll-ezpssiags.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://etoll-ezpssiags.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ff3c03c-0b3d-5248-8453-835b6f7b6da3","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"http://150.136.252.61","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://150.136.252.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef84dee-b97a-51b6-aec1-355d9db9ce89","created":"2026-05-11T18:30:00.000Z","modified":"2026-05-11T18:30:00.000Z","valid_from":"2026-05-11T18:30:00.000Z","name":"150.136.252.61","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.252.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053905532377833708"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34c44b8-30cc-5c0e-9de7-af4a2e462161","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"http://142.171.160.137:8888","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://142.171.160.137:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fbc5133a-217e-57cc-a235-84f768361be3","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"142.171.160.137","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.171.160.137']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c1d11c-bcab-52df-828e-ab3a9d7a8d43","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"142.171.149.169","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.171.149.169']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4976b5d8-909e-5b90-8ce9-7ca6d53d36f5","created":"2026-05-11T18:34:00.000Z","modified":"2026-05-11T18:34:00.000Z","valid_from":"2026-05-11T18:34:00.000Z","name":"100.81.245.29","description":"IOC reported by @SansLimit3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '100.81.245.29']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SansLimit3/status/2053906675430568281"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d054d4a4-90da-5870-ae8c-b9c1173b6cdb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmpoemqnmpj.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmpoemqnmpj.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b9a4b56-ea99-52ce-8762-57753047f8f5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmpoemqnmpj.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmpoemqnmpj.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--800b675d-5381-5555-bcb8-b1b790cc990d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imlbioxai.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imlbioxai.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d25c5f2d-a89c-54f1-8c58-1aa25d56ab55","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imlbioxai.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imlbioxai.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3e729f2-d2a0-520d-8d52-a339a94d7765","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmqgollpaij.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmqgollpaij.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fda142c-a7fc-57ff-906a-b3cc5ea16df6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmqgollpaij.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmqgollpaij.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ab01c1b-2852-594f-b075-86f3bad04acb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmyappwlwza.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmyappwlwza.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98fc17a7-dce3-5883-babd-79282306c89a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmyappwlwza.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmyappwlwza.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1feeefe-dfff-5ab5-bf6d-73fe7257c887","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmvxsybqika.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmvxsybqika.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3425720f-cb2a-5cc9-8839-4f28b2c570d3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmvxsybqika.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmvxsybqika.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c620406-5eae-5068-8651-9d98f67c9f8a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmmdkbebist.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmmdkbebist.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--118be536-2842-5a52-b13a-c7a6c245df3a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmmdkbebist.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmmdkbebist.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07d8363b-51a8-50a7-bb06-6bf21932b19f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmvtckrtdus.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmvtckrtdus.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b28fe1bf-0385-5290-bc22-155fb1a067d4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmvtckrtdus.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmvtckrtdus.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0963b1fd-e30a-5766-a698-e175e77bc610","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmfrpejvtno.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmfrpejvtno.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2cf1480-726e-539c-9ae2-d3dfae17288a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmfrpejvtno.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmfrpejvtno.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484316f0-6717-5737-89ab-173ea7521d6b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmiwoyseqiv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmiwoyseqiv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46330670-86bd-5d29-90c2-770465645eb3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmiwoyseqiv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmiwoyseqiv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01762379-6621-5378-9dcb-546c170f2bac","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"jmezzkwochd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jmezzkwochd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--beca453c-70a8-5447-acf2-022ce25c85cd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://jmezzkwochd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://jmezzkwochd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff56044a-d582-5423-8bda-01dc9037376d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imboeznibuk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imboeznibuk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dde74601-04fa-5258-a6ff-dd8a230d6007","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imboeznibuk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imboeznibuk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82505cf8-cba6-57e5-81c3-924296028413","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imtzdrlecxv.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imtzdrlecxv.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ba3e24-f730-5331-a531-5a05e9c54ea8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imtzdrlecxv.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imtzdrlecxv.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022ae418-e177-53b3-b2ca-d1c270e13d84","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imvfptssn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imvfptssn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05b8d5da-326d-59b2-af30-dc50f5063391","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imvfptssn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imvfptssn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cf4e3db-b0ce-5b4b-8acf-0bab27199858","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzmfkbbsewp.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzmfkbbsewp.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58765b6b-afe0-5dc4-a4ed-710b3a064c35","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzmfkbbsewp.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzmfkbbsewp.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--287ab754-527e-5afd-b5b5-a23af9f29def","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzvenuidipk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzvenuidipk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22a5b06b-5d59-5a80-a8c6-bc59b76edabc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzvenuidipk.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzvenuidipk.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f6d433f-ecb4-5312-bec5-27afb25dafa1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzrgwbmxiuj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzrgwbmxiuj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e1d4142-82a5-548b-8fe2-57332f86f8b5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzrgwbmxiuj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzrgwbmxiuj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03960af0-d89b-530f-8282-31d85beb8e89","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzsnlfjbutu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzsnlfjbutu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cc3cee0-e3f5-574f-8554-40616e4f36bd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzsnlfjbutu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzsnlfjbutu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--156646d5-b005-5687-a734-f768b4172c05","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzbvmihrfuq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzbvmihrfuq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b4f1dfe-a7b4-5547-a9b7-7c3483f17561","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzbvmihrfuq.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzbvmihrfuq.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dcd1931c-43be-544d-86d1-fd816456440d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzvuhwepflo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzvuhwepflo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b18f582b-f91e-5ff7-a064-2ae35a39bcd8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzvuhwepflo.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzvuhwepflo.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c42d2d96-b00f-50ae-98c0-4f1080631c76","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzsimgxmjse.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzsimgxmjse.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a5c2ef-fdf2-5ada-9332-e620b2045cb1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzsimgxmjse.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzsimgxmjse.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7799800-848f-5a84-9af3-2ca16ed5ba87","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzhaeuhucba.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzhaeuhucba.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c553d624-ee14-545b-af21-4eec25ec9a8f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzhaeuhucba.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzhaeuhucba.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebc190e3-1789-50ef-862f-37d41a92a7f0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzfznmyeovb.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzfznmyeovb.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42b0c3af-78e7-5c6d-9842-adfce9ddd99b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzfznmyeovb.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzfznmyeovb.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc16127a-c044-5198-a008-6586d6d1de38","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzomshrstkm.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzomshrstkm.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--477224b4-dea8-5fc3-8063-72891f38d323","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzomshrstkm.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzomshrstkm.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd22130d-70f3-5de4-931a-ea029a3ebbef","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imyflphhjqu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imyflphhjqu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a7cde8f-eedd-58b1-9404-10e9578f9c6c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imyflphhjqu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imyflphhjqu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8970a5d0-1cfb-53fa-9198-7df823b064c7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imweqtnvyqw.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imweqtnvyqw.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d1b89d-ad4f-5e99-88ab-09aa03c86d86","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imweqtnvyqw.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imweqtnvyqw.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--784641ee-51c0-5aa6-b623-850517669fa0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhsvamtlso.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhsvamtlso.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3b05606-1583-5e99-a592-a3b1cbb3c8b1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhsvamtlso.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhsvamtlso.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07ce300e-3e84-5830-8553-6a98149f18c6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhyuyzlmix.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhyuyzlmix.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aad5dc39-42aa-549b-b45f-bddb0dcaecda","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhyuyzlmix.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhyuyzlmix.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c44578ef-8383-5c50-98d2-f4f6392c11c3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imxdxzhmtju.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imxdxzhmtju.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f21ba838-feaa-582b-a729-0095a2d81ef1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imxdxzhmtju.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imxdxzhmtju.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d23ed644-47c0-5c0c-86a6-2f9294d6ed10","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnxofrpdik.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnxofrpdik.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82d32ff2-0952-5b36-9351-c43b4aab5e58","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnxofrpdik.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnxofrpdik.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ce6f9e-3c1d-59fa-8e31-9d265032f013","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imiiuyuvhfe.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imiiuyuvhfe.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7946fcee-dc6d-53c7-b97f-93decfb2efdb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imiiuyuvhfe.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imiiuyuvhfe.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a9f75c8f-4e0d-5a43-85be-dd90b267922b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imypevsnxap.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imypevsnxap.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ea8825c-5a74-5de5-b377-bb762187d914","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imypevsnxap.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imypevsnxap.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02e5ceab-d99e-5f9e-a17c-56766ff65cc3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhsiexkoyz.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhsiexkoyz.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d48e7c-fc5c-5d80-8b11-107315c52f32","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhsiexkoyz.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhsiexkoyz.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2db7ccbe-2a5f-5a7a-8671-a3521bdefede","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imorelrlvgj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imorelrlvgj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7864eae-8749-5c14-98f2-8fd413082e3d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imorelrlvgj.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imorelrlvgj.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86c7b73e-06e9-5998-8037-fa710b53b450","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imlqzydpehu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imlqzydpehu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb6495fe-9e27-5f3a-b110-e2d59ebe9ad6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imlqzydpehu.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imlqzydpehu.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f9bfef1-431d-5913-8607-47b40954e1b6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnnaghfftl.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnnaghfftl.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03d08577-ee0f-5383-ac77-d9167c6de8c2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnnaghfftl.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnnaghfftl.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--087999d2-941f-50e9-8c38-f3e88567ceb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"impolsmes.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'impolsmes.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bad33c4-974a-5138-b03f-97f95bafb446","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://impolsmes.abrdns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://impolsmes.abrdns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca139711-1dd5-57b6-aab2-1e60b5a95e46","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imltrdtzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imltrdtzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--530bdeaf-8037-5f64-8d1a-77968cbc5cfb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imltrdtzo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imltrdtzo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--717fe050-50e1-5ee1-9af5-0cd3018919e4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imhpqwwma.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imhpqwwma.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d9ccf1-7115-5bbb-92ae-36e0ddf16c3d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imhpqwwma.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imhpqwwma.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce021e54-0692-59f2-bb20-13756e987082","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeij2jof.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeij2jof.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29ab1e4b-9822-5a88-be64-528bc4fb8aaf","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeij2jof.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeij2jof.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7c5361e-8f64-5747-9837-3ae0dffe98b8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imnrhbcpg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imnrhbcpg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe39fb67-6454-56e7-86d6-92471d40ab4b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imnrhbcpg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imnrhbcpg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4b05fe8-7a41-5ce4-a069-29baea13145b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imqkodvnh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imqkodvnh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ff9347c8-d176-5859-8de5-cad9984ddeb1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imqkodvnh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imqkodvnh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f17e361e-f06e-5efd-9b03-b6de448e279e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imawiirlf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imawiirlf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44239f23-0436-526d-96a5-8e58cee0f967","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imawiirlf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imawiirlf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d02463ce-7c78-5d4b-abe6-e144479b2803","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imdildckx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imdildckx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f5410e9-0c1b-5a8d-95b5-4dedb8ad31e5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imdildckx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imdildckx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eefc789f-2dce-5d42-b4e9-10e80f203ee1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imfueakgr.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imfueakgr.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c33c4ca2-6ec7-50eb-a7d7-49b78f337048","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imfueakgr.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imfueakgr.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--216ed232-8a9d-54ba-989a-2b0c38f1cd8b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeqlvedp.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeqlvedp.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c96ca4de-e510-53d3-9220-2a8b4ed8e881","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeqlvedp.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeqlvedp.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d15ff38-19d0-563d-92c3-0bb34f59df0b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imzrutppj.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imzrutppj.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--952d8df9-08be-51a4-b1d6-2fbaa58dbd68","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imzrutppj.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imzrutppj.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9577d6e-58e1-590e-897e-2823a540b997","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imwywutdl.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imwywutdl.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--419f27b1-71b0-53f4-a3f6-70c8636fffe1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imwywutdl.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imwywutdl.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e29ad360-4d7f-59ec-990f-c5fa13bae047","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imofwmyzu.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imofwmyzu.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c65e5ace-074b-5a35-83a7-e114abf0a7a1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imofwmyzu.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imofwmyzu.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9db6db4d-396f-5a1d-bee3-bea9e3800eab","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imklevubf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imklevubf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34410625-2864-5cd6-81c0-6c52156e5bf1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imklevubf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imklevubf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe6ab11b-ee92-561a-a718-b041e2edd093","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imwfbmotn.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imwfbmotn.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--146644d7-36b4-5eab-84ca-43d8e40e7d28","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imwfbmotn.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imwfbmotn.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df04a25-9598-5107-8680-054f3c26377c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imuvtahho.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imuvtahho.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7833d61-e628-5631-b7aa-e64600026375","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imuvtahho.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imuvtahho.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44bdc968-4616-516f-b0af-8b20fae9acae","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imqyeosse.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imqyeosse.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8bf1a6f-baaa-5f59-bad0-67dbc778f443","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imqyeosse.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imqyeosse.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--456a11e5-b981-51bb-bb93-eee675111655","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imkxrlawh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imkxrlawh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--841bee73-720e-5e71-95f4-30b24bd3ab07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imkxrlawh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imkxrlawh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a10b8c5b-d0bc-558f-9a50-03c735335cb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imgkbwcaa.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imgkbwcaa.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98e8e909-2729-5cb4-9519-a2d64ebf37d0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imgkbwcaa.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imgkbwcaa.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53090444-3c51-5eed-ac96-7c9b928e965d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imevznwcg.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imevznwcg.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b025f6b-f154-5460-9ddc-b21a3535f48d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imevznwcg.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imevznwcg.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b9fbcb1-e103-5b90-a482-460295fa920d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imewesroh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imewesroh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8912f788-26be-5ca7-8044-488418ef597f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imewesroh.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imewesroh.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ba9437d-3875-525c-b8d6-ef2cda3e73ab","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imacfgmbf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imacfgmbf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d30b61-0fe3-5d10-b64c-0f696cb9b613","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imacfgmbf.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imacfgmbf.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f59fa26f-6d60-5c25-b704-0666738701e8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"imeasniku.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'imeasniku.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f70a6272-7742-5f51-8f04-323ff70cbe50","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://imeasniku.v6.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://imeasniku.v6.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9098838-4803-5050-a812-137b3d84429f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmxpybvuc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmxpybvuc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd0c086f-bad2-52e6-8ebb-c3f387e162f3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmxpybvuc.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmxpybvuc.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb842801-41f6-50c3-83a8-2e9b87e9012b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmhszflpi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmhszflpi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--082769c3-bc10-51e5-b69b-a7c1d0b329cc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmhszflpi.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmhszflpi.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34394504-3bf7-57d5-8621-c761e6db2ab6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlgnwldm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlgnwldm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e53fcfb2-88cb-5ec7-927e-4ce95f815446","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlgnwldm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlgnwldm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e82e51f-99cb-5215-92db-b8a68f5a6b29","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmmslgieh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmmslgieh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55d7a67-8939-51ff-81c3-e4fc1eeff194","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmmslgieh.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmmslgieh.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef1aa08-a590-5669-9094-ee3f6c22fdd1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmxazemwg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmxazemwg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f645bf3-2a2c-54a0-b9e1-f0f7bd843bc0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmxazemwg.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmxazemwg.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ba39be2-5155-5222-8c9d-1b6c1021986f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmitjxofe.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmitjxofe.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--960f3b90-4a71-5943-89b9-aead61b8fa45","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmitjxofe.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmitjxofe.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--141500ad-04e3-5ab7-81e9-b43d05920eb0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlvlkmrx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlvlkmrx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4388a145-d58e-5dca-a6e7-052cd51cafff","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlvlkmrx.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlvlkmrx.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56fa2cd8-84b1-5f8f-8248-4e9c9fe74604","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmdihnrqd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmdihnrqd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022b5392-8ac4-5d78-a5c6-eaa95799615c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmdihnrqd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmdihnrqd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--053b1a5c-781f-533f-8a8a-5a01dbe179a9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlxyvdfd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlxyvdfd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0601fd4-c703-59a9-b1c8-4f143b47635e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlxyvdfd.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlxyvdfd.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f86f2b0-34f5-526d-aea8-8cd66ceb7e51","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmluuuyqv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmluuuyqv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a0c9774-5c97-515d-b284-9c98a8816226","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmluuuyqv.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmluuuyqv.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dad5f0c8-89ee-57f1-98f2-8e30298baa66","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlicoxiy.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlicoxiy.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20c3db4e-89c3-50b4-8148-0e9dda25db58","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlicoxiy.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlicoxiy.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9e22d6f-ff88-5596-bc87-ae2285291528","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpavordl.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpavordl.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f63be246-3693-5b8a-be16-3dcc0ca66aa8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpavordl.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpavordl.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e471e109-bf66-536d-89d6-52eba52771b6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpzzjggs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpzzjggs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1516122b-56e8-568b-a1c6-61b6129f3c43","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpzzjggs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpzzjggs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc91eb8a-c782-53c3-a90e-2efd83ea517a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmvrbxkgs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmvrbxkgs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c3102ce-75df-5fb3-9f7b-59f8a3099ffe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmvrbxkgs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmvrbxkgs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--521849b2-7d13-5769-889b-067f7cddc6ed","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmqmrttdo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmqmrttdo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52260713-0d0f-5a90-85c8-3e4127eab023","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmqmrttdo.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmqmrttdo.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9f5ab22-a894-5ad1-a493-9da68bb36790","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmgysllbn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmgysllbn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ce0f481-ea4b-55e1-a92f-97e742fc867e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmgysllbn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmgysllbn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f0a63a6-9ce0-541f-875e-99203c76e526","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmbjutevk.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmbjutevk.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ae6434e-bd91-5d06-8cfa-0a6a557b0bbc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmbjutevk.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmbjutevk.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371a3a8e-b030-53bd-843e-aa02b6d92c7d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlojxudi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlojxudi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba003de5-ff87-5327-83a2-038935f51ab2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlojxudi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlojxudi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d9a166-4a7c-51d5-bb53-d84700acedd9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmalfgloi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmalfgloi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cafbf246-657b-5596-a41e-83e42086c4e2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmalfgloi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmalfgloi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9195ca3c-c3b9-565f-9dbf-d65574bc7680","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmaiyvhxx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmaiyvhxx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--964e90cd-3d4d-54bc-9a8b-9f2182908d87","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmaiyvhxx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmaiyvhxx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e78d764-ad25-521e-a2ca-24dbc1475f01","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmshyqlvd.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmshyqlvd.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd46c997-d9d0-5ecc-ae14-1b1b7ba47e7d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmshyqlvd.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmshyqlvd.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26126a71-0e77-53e4-b688-460c1c6af242","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmpomqnzl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmpomqnzl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03448f12-bac5-57dd-8fb4-856fef0a51de","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmpomqnzl.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmpomqnzl.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cc2635-511a-5c2e-882a-a0ad5f87d2d1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmrtuleuq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmrtuleuq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfaae312-23e3-52d7-811f-f031b7015b7f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmrtuleuq.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmrtuleuq.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db79c681-d0a7-5558-b1e3-5050ffe10956","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmnqgrdvi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmnqgrdvi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--addb9cba-e80b-59ff-bb51-8454bacea26b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmnqgrdvi.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmnqgrdvi.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37305010-5768-592d-841a-f04ef4b39b1a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmypfihui.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmypfihui.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66f63e99-be4a-5565-8559-94e8ed59ebbc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmypfihui.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmypfihui.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5015cc98-04d3-5ec1-93f7-b42ec049e62a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmlwykhre.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmlwykhre.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a564734-1c93-5931-977a-e5e450ba847c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmlwykhre.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmlwykhre.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968da71a-439b-565e-ace9-45d815752b3b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"hmhlfzokh.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hmhlfzokh.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05290247-8442-5ddc-8779-64d22fe416dd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://hmhlfzokh.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://hmhlfzokh.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4d3dcbf-dbe0-57f1-ab34-d26cf08b1a71","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gseminuko.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gseminuko.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fccc606-6f99-5183-99bb-b4a0cbc7e208","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gseminuko.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gseminuko.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--402d27ce-3301-5304-93a8-6510937d6521","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmnwdhnupf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmnwdhnupf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2c0e3fe-e932-5fcc-b6e5-ac161f2a50d9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmnwdhnupf.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmnwdhnupf.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1446c885-acc1-5f9a-9af9-1fa176ff8d07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmjryqloxn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmjryqloxn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb51a11e-a821-5569-9f68-e57de7805be3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmjryqloxn.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmjryqloxn.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bfff3411-7c44-5a23-9711-d8911e9df9b2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmvbchibgq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmvbchibgq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e71a78dd-f084-56b3-8900-71ed2428becb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmvbchibgq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmvbchibgq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a558cc-2de1-5ba8-8b22-8466cdd452ef","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmhbilzscs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmhbilzscs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c254869-e837-5dd3-9876-e845ae122ffe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmhbilzscs.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmhbilzscs.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d786bc57-7c7a-5b42-a44b-8cc3f866e39e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmycyrkwsq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmycyrkwsq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2634c8cd-f15e-5214-b12b-a2d4dc0dafdc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmycyrkwsq.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmycyrkwsq.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--210d9a98-8cb2-59c8-bd5b-b234bbe25886","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmeinuljww.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmeinuljww.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c477f544-c611-57a2-9b8c-d43f260efadd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmeinuljww.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmeinuljww.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7d0e7a1-6e63-5768-a428-d6a32b2eacfd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmgwuancky.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmgwuancky.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--019b0f84-c6d8-5cb4-9b3b-42e2bda9d762","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmgwuancky.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmgwuancky.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a00019fa-392d-5515-b6d4-77ca526a58db","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmdqriyusm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmdqriyusm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed440d35-5743-5967-aee6-a4503e992cc5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmdqriyusm.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmdqriyusm.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6c904b5-b193-557b-b02c-c32a9061b832","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmfvuwioeweh.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmfvuwioeweh.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4cf7709-becc-5193-ad0c-6f31c64fa8b3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmfvuwioeweh.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmfvuwioeweh.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9291b4-9ff3-54da-ab71-4f52cf4fe389","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmgwuahbji.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmgwuahbji.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb59e44-b403-581e-981e-4851c00b0214","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmgwuahbji.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmgwuahbji.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d5a266e-610a-579e-82b8-fdad8df4bdc0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gmbxacmels.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gmbxacmels.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ef90042-7e2e-5bc2-a134-e15528de6ccd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gmbxacmels.v6.rocks","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gmbxacmels.v6.rocks']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a72a24e-44f5-59f0-b206-2d1db2118295","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gpointedinfo.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gpointedinfo.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de9e5dd-7eb9-5ee1-87d2-18152ba40fe8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gpointedinfo.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gpointedinfo.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2523070b-99a0-5104-810d-fa1bfc54252f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gpotmains.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gpotmains.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--901876eb-a908-5159-ae49-a8507cebb9d3","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gpotmains.twilightparadox.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gpotmains.twilightparadox.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b760978-6c13-5970-a1ff-466324b388bb","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fpericyjin.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fpericyjin.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3cc21a6-9aa8-56b0-962f-dad4eb0c038b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fpericyjin.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fpericyjin.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4320fa17-4343-54e7-b67b-8dc08f25e49d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"folkd9info.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'folkd9info.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8835b3d-dada-5ed7-a4b0-ec181a590f2f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://folkd9info.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://folkd9info.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97cb7f3a-9418-5f95-8872-eb54ec1c19f6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"flexinfon.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'flexinfon.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49f7824f-2ce8-550b-8523-14d70c3fa993","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://flexinfon.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://flexinfon.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6f543bc-0a20-50ba-bac9-d9d96b2c4a25","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fkonsqilz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fkonsqilz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a486e4f-75e2-5d16-a24d-2cd79101f999","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fkonsqilz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fkonsqilz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17941875-265a-51d0-a546-ea234c9e3da4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fisnispull.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fisnispull.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce8f8d48-3088-5f92-9063-1e42c3d0115d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fisnispull.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fisnispull.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a82a820c-6293-527f-a2ab-858cd882102b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fhozinftei.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fhozinftei.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ba28c9e-9ff3-5874-a7f7-0e2c31ec94ad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fhozinftei.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fhozinftei.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--622de4f6-93ec-5f04-8b40-e3b5d92de548","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eonse71hc.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eonse71hc.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63f60a6a-8b0e-5e06-b5be-1e0e84574e09","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eonse71hc.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eonse71hc.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93269fdf-1c4e-5b37-b803-9dcfe9d356b2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fhopcixim.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fhopcixim.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dadb9761-b317-5a04-a38a-06480a0f8179","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fhopcixim.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fhopcixim.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48051202-d83b-53e5-94fb-cdf3c8019203","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fearinronz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fearinronz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56954d24-a0b3-55e4-948c-ea2c88e67f07","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fearinronz.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fearinronz.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--484108aa-c3bf-5a2c-959c-816465ef243e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"fcaset29.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fcaset29.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f3af1db-ddb3-5938-8543-fd11e1880ec4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://fcaset29.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://fcaset29.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31f94461-9605-545c-8cd4-2e9d1063046e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"epa12cdiq.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'epa12cdiq.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89238fbc-8927-5908-8d10-b8d5b40f754e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://epa12cdiq.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://epa12cdiq.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--959d8a22-a98f-5f00-b51b-184d8563af9e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ec8yxeon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ec8yxeon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43da6fee-2b9c-5b84-8fc3-8fb1cfca20df","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ec8yxeon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ec8yxeon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09a46f03-0b4a-5908-8c18-de52d891207e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"edn8uo7z.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edn8uo7z.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b43bb69d-1476-534b-a306-ecceac4cc517","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://edn8uo7z.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edn8uo7z.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd911ca3-afa7-518c-b133-e828330ffc64","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eo90boios.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eo90boios.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6350e48-92db-57ed-a95c-1d219c149bb4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eo90boios.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eo90boios.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--865cda2c-1cb5-5a8d-8bf6-86387cf3674d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"e1ia92c90tz.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e1ia92c90tz.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1962a6be-1e4d-5799-aece-cc13223d14e9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://e1ia92c90tz.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e1ia92c90tz.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--706d8bb3-1804-59b6-a59a-dc64754a3d13","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"einfa8a30.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'einfa8a30.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7365ef04-4d1a-5a07-a136-8802b9e96dde","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://einfa8a30.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://einfa8a30.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--963a8f34-f419-5d02-ae8f-c0749c556d30","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ef125dioaz4.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ef125dioaz4.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d00588fd-0ed9-5486-a709-9e205ba0510c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ef125dioaz4.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ef125dioaz4.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7d27d4b-78e5-535e-8907-c66f7ed8431f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"evisin193.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'evisin193.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c54f464e-19cd-5a20-9b4f-9fcba2259cd4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://evisin193.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://evisin193.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1de01ed7-4fa2-5c8b-896c-fb3fc0668a2a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"esimdgit1.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'esimdgit1.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--360b805b-9b3a-518a-892c-243716cf07b0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://esimdgit1.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://esimdgit1.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cf8094a-a4bd-5da7-b1ae-e180850dc3ee","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"daurora.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'daurora.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26b91549-3b94-5fe7-82bc-f43130dec81a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://daurora.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://daurora.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b9e6fa7e-6bd5-541d-939b-9acbd0fd6afa","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dtickaree.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dtickaree.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c600466-ec0d-51a6-9e69-fdc37af496a1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dtickaree.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dtickaree.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc1af65b-7174-5589-bef4-0f52110cea77","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"duxopenor.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'duxopenor.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13d24792-f365-5952-a30e-4f70cefc5ebe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://duxopenor.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://duxopenor.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--17ed1f40-7feb-554e-acdf-6e926bd30b65","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dynazdom.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dynazdom.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fb9a942-14ff-54ae-a4c9-5d1db727503f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dynazdom.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dynazdom.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02f1d717-fd84-5e04-a9d8-3c294e4f6ee2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dsarapiz9.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsarapiz9.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f44237ce-16c7-593f-bd78-161cf0fdefcc","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dsarapiz9.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dsarapiz9.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58585d08-e3fa-5e4e-85ac-a3ab83902574","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dso9asops.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dso9asops.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd15e282-0356-5aca-a771-9acf45535326","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dso9asops.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dso9asops.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--141b2e84-8ed2-5990-b536-4a2203391fd7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dcamso10.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dcamso10.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16becda0-1937-5f01-b26f-f4416a3f08f8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dcamso10.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dcamso10.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--277dbe1b-9c46-59a3-8e51-de9b0bb73447","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dhonexc.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dhonexc.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a103d4-8534-5319-8d9d-5606d2572440","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dhonexc.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dhonexc.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6bdf967-dc4a-56e9-b811-4ba074d97a79","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"dsolanosi.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsolanosi.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f81a8e-045b-5a16-b311-1bc4ea8518d6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://dsolanosi.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dsolanosi.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d50a289-4d5b-5ced-930c-acf34094b13a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"412949853a02b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '412949853a02b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d16d8b2-bb1f-5b9e-ae1c-a20da0c3d7e4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://412949853a02b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://412949853a02b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--029f859e-7d43-552a-991a-49b2f59616c9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"us2loadinfo.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'us2loadinfo.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef9245f0-6fad-5629-b7ce-7fd3aab6dde0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://us2loadinfo.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://us2loadinfo.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--adb9ca41-245f-5f41-a3e8-71e9a2b6ca0e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eclodfast20.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eclodfast20.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34921434-dbc7-5702-b1f4-6d0c6a73480a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eclodfast20.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eclodfast20.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d43bb758-e5f3-5e61-97af-34e70a5e4b2c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"e10a9e5.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e10a9e5.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6380e322-6015-51b8-b925-8d49bce7111e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://e10a9e5.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://e10a9e5.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ac6f382-a161-52a3-acea-42672b9f8c2a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"t18delivery.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't18delivery.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46568a5d-06b2-505e-b55d-b0288e755535","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://t18delivery.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t18delivery.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3193511-8a75-5f74-b211-0a833fb88766","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"comdeliv72.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'comdeliv72.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c42f96af-baac-5f31-94d0-5f49fed8683f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://comdeliv72.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://comdeliv72.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db6447cf-290e-5ec0-b827-cb94838f805b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"deon0capload.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'deon0capload.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c2e72a2-10eb-576e-90b4-aca3d5c4efad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://deon0capload.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://deon0capload.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ff17032-979d-5dba-9e6d-5742c5c40103","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"trackinfo0.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trackinfo0.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c74e7d64-da2a-5643-b81d-af302e8e5329","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://trackinfo0.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trackinfo0.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d63b988b-7841-5d14-8fef-715eeac247f7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"sudeliveryn.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sudeliveryn.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cb34bd0-4111-520c-9b3e-e83077782e32","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://sudeliveryn.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sudeliveryn.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6521ff2-172d-5054-9474-b432ef62f532","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"eclodfast20.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eclodfast20.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7e74d26e-99d4-5ff3-ade6-d9d52aad92b9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://eclodfast20.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://eclodfast20.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4eb68a08-b294-50ff-973c-6a88e02e8c34","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ecxfastpostx.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ecxfastpostx.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--396bedb4-dcd9-5d93-908d-bba30b81d7bd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ecxfastpostx.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ecxfastpostx.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--543db785-2100-570f-8133-65bee188a182","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"comdeliv72.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'comdeliv72.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--696d0f45-83ec-5396-b5d0-0a02ec06f20e","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://comdeliv72.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://comdeliv72.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27f36899-0c4d-5e2f-88c6-7c25b5e94bd1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"trackinfo0.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trackinfo0.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ce716f4-c3f7-53ac-bfee-677dacd0edce","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://trackinfo0.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trackinfo0.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a79e8c4-d8ff-56ee-98e4-b06588678057","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"us2loadinfo.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'us2loadinfo.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--33ae6c5f-c2ee-51bf-88bf-3cceded402f6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://us2loadinfo.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://us2loadinfo.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0382fe2c-f5e3-52fe-b914-4a94adb0ea41","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"sudeliveryn.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sudeliveryn.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61c9a3b8-f504-5260-be5e-75450f2f7c75","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://sudeliveryn.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://sudeliveryn.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31067cc1-e446-5dd1-af8b-e15a656a8668","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"micload4.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'micload4.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a649d961-1ea4-54dd-870f-23366abf60d6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://micload4.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://micload4.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--796c42a4-198b-5249-8dcf-513da561cc74","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"t5delivery.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 't5delivery.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f6e6795-7f3e-5d07-982d-e3b274732dcd","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://t5delivery.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://t5delivery.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f596416-d2cc-5441-bf48-a5fd6faca664","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"ecxloadon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ecxloadon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47ebd830-e3fa-5ac1-b4e0-cbd7002468f5","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://ecxloadon.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ecxloadon.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d0fef8b-78d0-5535-a327-8ea11aba3a3a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"deon0capload.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'deon0capload.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f6c86643-5bf3-5872-ae3a-4b0383731c8a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://deon0capload.entrydns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://deon0capload.entrydns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23743534-f611-5708-80d9-c2bc727dd99a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"gate.dnsrd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'gate.dnsrd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--734b7f11-0504-549c-a7ed-d746b8f9b548","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://gate.dnsrd.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://gate.dnsrd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9973779a-cd6b-59f0-bc5a-a6680065bdc6","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"camcdeliver.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'camcdeliver.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d6fc3ce-9f8e-5061-aaa7-1ac75a68683c","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://camcdeliver.libfoobar.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://camcdeliver.libfoobar.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66a798da-87a8-5d9f-b49d-9aaf5cc896b8","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"a51a.otzo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'a51a.otzo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9162c00-cecb-57b2-9208-e6659d9f832b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://a51a.otzo.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://a51a.otzo.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59c39227-6333-5b8c-ba3e-03526e8eddc2","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"42019239a0s0be.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '42019239a0s0be.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56437815-172c-56d4-96df-6774dcb26784","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://42019239a0s0be.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://42019239a0s0be.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--105ece05-818d-5627-be05-837832bd4cae","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"4c0a910fba9s1235.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4c0a910fba9s1235.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37a3e308-2da5-5e75-a1b3-55b7b0285140","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://4c0a910fba9s1235.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4c0a910fba9s1235.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98c5bfdb-2420-5438-b75e-f032ab5db092","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"419298as9bo2.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '419298as9bo2.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f501abed-5d33-5479-a5ec-acfbd0a94740","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://419298as9bo2.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://419298as9bo2.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31958301-82cc-5b16-9cbb-c1f18e562d1d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"491va9924abef1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '491va9924abef1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e255be7e-7cf1-511e-a728-ddd95e24d06d","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://491va9924abef1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://491va9924abef1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68b15520-bc3d-5d23-b619-42d77b769b59","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"48716ba0dea01.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '48716ba0dea01.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1369ca46-1599-5c95-8557-79594dec0a81","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://48716ba0dea01.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://48716ba0dea01.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86e06d48-f310-5f67-a4eb-f0660712d935","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"48d9a9120bae.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '48d9a9120bae.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5a68839-9cbe-5628-97ae-9165018043b4","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://48d9a9120bae.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://48d9a9120bae.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8cc567-ad8b-57b6-86f3-a33823eb78b0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"441929450c2er.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '441929450c2er.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c427a81-65ae-5714-9c28-904c6905ebfa","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://441929450c2er.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://441929450c2er.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--371a099d-c1e0-5ed7-a6b6-4872a8d2dfb9","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"4d0q91239eqb5.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '4d0q91239eqb5.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--493d2ae4-3dfb-50c7-b26c-eac2089e0762","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://4d0q91239eqb5.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://4d0q91239eqb5.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cc041ec-8e41-5b8b-a4fc-1a8e02e488e7","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"489817asd9bo.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '489817asd9bo.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f830139a-a624-54ee-9b03-eacbfca412e1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://489817asd9bo.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://489817asd9bo.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71cf091b-68ca-55f6-80f3-437b08c85dad","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"di812fvz.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'di812fvz.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--088a7337-73bf-5912-85cf-95a2fb617b1a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://di812fvz.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://di812fvz.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed1680f7-dc86-5571-8a22-4bc8da1bd62a","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"p291z0sin04a9.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'p291z0sin04a9.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86189d49-03b4-5972-aa06-b3f83bde50d1","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://p291z0sin04a9.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://p291z0sin04a9.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44d73e7d-11be-5801-ad0f-c5de769fe61b","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"as912jci1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'as912jci1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4fbed31c-0a23-58a3-a246-3ced2e030582","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://as912jci1.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://as912jci1.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e72a9ad-6f8a-5111-9a1e-955485f4b5ba","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"1928fjcia025.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '1928fjcia025.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--757e2398-019f-511f-add0-ec6a0eca9e10","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://1928fjcia025.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://1928fjcia025.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c6080d1-d04a-5049-80b0-f33689a9f715","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"c0ea0s217.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c0ea0s217.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5d4cc38-a01f-5d9b-be2f-2906ad0ff294","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://c0ea0s217.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c0ea0s217.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84899a41-f2d2-5638-b183-f7091c89a009","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"00a7c185.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '00a7c185.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9b20961-d731-5b00-a945-f9e61ff9e1d0","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://00a7c185.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://00a7c185.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1acca91a-36ca-5204-92f2-43a6ef022373","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"96ad0e.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '96ad0e.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bff8d1a2-c2cf-5da2-9012-22173d0b1401","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://96ad0e.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://96ad0e.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10da5646-6f2e-555c-b8b7-40d4a86fcf28","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"102c928da265b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '102c928da265b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c1c4732-fc8b-5d21-a2cd-12c5180746ff","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://102c928da265b.duckdns.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://102c928da265b.duckdns.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8432931d-8b16-5893-8a2a-e20fd893e55f","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"http://152.32.139.126","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://152.32.139.126']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62187b98-f0da-5407-8a7f-9cf5565456fe","created":"2026-05-11T18:42:00.000Z","modified":"2026-05-11T18:42:00.000Z","valid_from":"2026-05-11T18:42:00.000Z","name":"152.32.139.126","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '152.32.139.126']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2053908641653100604"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fe2d1be-2f79-5c12-b89f-b65307f24b65","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"http://5.252.155.27","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://5.252.155.27']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--45a24dcf-600e-5032-8da7-74f52e889f63","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"5.252.155.27","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '5.252.155.27']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--12522f1c-d8d5-51dd-bd9c-f8b9690868fc","created":"2026-05-11T19:48:00.000Z","modified":"2026-05-11T19:48:00.000Z","valid_from":"2026-05-11T19:48:00.000Z","name":"65de4ef064eba4afe141fd4226cd7cd96a1eaf9a6f2e47d3d9ed2aa4e257396e","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '65de4ef064eba4afe141fd4226cd7cd96a1eaf9a6f2e47d3d9ed2aa4e257396e']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053925235510976551"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--93b08c5e-605e-5fdd-a2c8-4eda82c63f12","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"l1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'l1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4072ae1-a467-5deb-9eb4-0e948231c407","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"http://l1.topayapp.org:65512","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://l1.topayapp.org:65512']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bcca5ba-05e3-5464-9abe-3269ef96b6cd","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"ws.z2s.us:2095","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ws.z2s.us:2095']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--df3b509a-d593-5619-8712-6a49bbba74a4","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"http://ws.z2s.us:2095/code","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ws.z2s.us:2095/code']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c98aa18e-7fdf-565f-b367-cdeee987801a","created":"2026-05-11T19:53:00.000Z","modified":"2026-05-11T19:53:00.000Z","valid_from":"2026-05-11T19:53:00.000Z","name":"30df480a1b77469d441a904bae2c7913ad89f82773437ed8a5166c2425ce7b30","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '30df480a1b77469d441a904bae2c7913ad89f82773437ed8a5166c2425ce7b30']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053926493512671502"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7427265b-febd-528f-b01a-ddc162255048","created":"2026-05-11T20:00:00.000Z","modified":"2026-05-11T20:00:00.000Z","valid_from":"2026-05-11T20:00:00.000Z","name":"exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053928163021914584"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fded5383-1c16-5986-bcc3-cc1d1bf1f86d","created":"2026-05-11T20:00:00.000Z","modified":"2026-05-11T20:00:00.000Z","valid_from":"2026-05-11T20:00:00.000Z","name":"https://exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://exodus-ten-five-sigma-dfasf-98457-343564-goa.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053928163021914584"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1520cb7a-781d-5554-9b48-f67e56e2c6ef","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"forecast-exact-defined-determined.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'forecast-exact-defined-determined.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c6711af-d42d-57b8-83b0-e99d505833ae","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"http://forecast-exact-defined-determined.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://forecast-exact-defined-determined.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--417097e3-0408-5394-866f-dbd100168e54","created":"2026-05-11T20:14:00.000Z","modified":"2026-05-11T20:14:00.000Z","valid_from":"2026-05-11T20:14:00.000Z","name":"7ccee0bc59cc09e48a3cd99f2cbcd0f478f6503d478042afc660902c1237020a","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7ccee0bc59cc09e48a3cd99f2cbcd0f478f6503d478042afc660902c1237020a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053931661214061040"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--28c9b8bb-d395-51ce-84a0-ff4b6a256950","created":"2026-05-11T20:34:00.000Z","modified":"2026-05-11T20:34:00.000Z","valid_from":"2026-05-11T20:34:00.000Z","name":"http://130.78.217.194:8888","description":"IOC reported by @malwrhunterteam on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.78.217.194:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/malwrhunterteam/status/2053936774099956147"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e883281-a4f8-599b-ba21-1a17230b0a80","created":"2026-05-11T20:40:00.000Z","modified":"2026-05-11T20:40:00.000Z","valid_from":"2026-05-11T20:40:00.000Z","name":"a4e560c61861c4c3d6d614217d93f38fadea8ee6b127ccd85618ff4312582600","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a4e560c61861c4c3d6d614217d93f38fadea8ee6b127ccd85618ff4312582600']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053938334456504462"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4955f368-a47b-57f2-bf9e-18efb73d92b9","created":"2026-05-11T20:45:00.000Z","modified":"2026-05-11T20:45:00.000Z","valid_from":"2026-05-11T20:45:00.000Z","name":"db7680c1636d67085bbd7ea3a15017b4f53bfdd17b0b134c4b3f43ff7f925a6c","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'db7680c1636d67085bbd7ea3a15017b4f53bfdd17b0b134c4b3f43ff7f925a6c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2053939515195023656"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a34b8681-4550-5adc-8ff7-fb881ed22606","created":"2026-05-11T22:00:00.000Z","modified":"2026-05-11T22:00:00.000Z","valid_from":"2026-05-11T22:00:00.000Z","name":"3242329-gwdg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '3242329-gwdg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053958372089643141"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a0784cc-d277-5137-b953-63afb4cc90b1","created":"2026-05-11T22:00:00.000Z","modified":"2026-05-11T22:00:00.000Z","valid_from":"2026-05-11T22:00:00.000Z","name":"https://3242329-gwdg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://3242329-gwdg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053958372089643141"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bea10e3-05e7-5762-bdfb-d2c37d12ab88","created":"2026-05-11T22:34:00.000Z","modified":"2026-05-11T22:34:00.000Z","valid_from":"2026-05-11T22:34:00.000Z","name":"bk.muflg.top","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bk.muflg.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053966988641497355"}],"labels":["scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a020271a-d348-5ec9-a582-911ce7d7ccbc","created":"2026-05-11T22:34:00.000Z","modified":"2026-05-11T22:34:00.000Z","valid_from":"2026-05-11T22:34:00.000Z","name":"8.216.44.55","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.216.44.55']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2053966988641497355"}],"labels":["scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ceb8b863-29dd-5c49-a6a3-37163abe8f49","created":"2026-05-12T00:00:00.000Z","modified":"2026-05-12T00:00:00.000Z","valid_from":"2026-05-12T00:00:00.000Z","name":"wccupdate.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wccupdate.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053988688929898680"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--607cc1ff-af21-5a36-bf03-2c6f0e67a65f","created":"2026-05-12T00:00:00.000Z","modified":"2026-05-12T00:00:00.000Z","valid_from":"2026-05-12T00:00:00.000Z","name":"https://wccupdate.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wccupdate.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2053988688929898680"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14e6a87a-a0c4-5b85-90f4-d28e5fdfad66","created":"2026-05-12T01:44:00.000Z","modified":"2026-05-12T01:44:00.000Z","valid_from":"2026-05-12T01:44:00.000Z","name":"bovurozef.z32.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bovurozef.z32.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054014907600052720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--02f92006-9546-51d1-bd71-d449f462fd85","created":"2026-05-12T01:44:00.000Z","modified":"2026-05-12T01:44:00.000Z","valid_from":"2026-05-12T01:44:00.000Z","name":"https://bovurozef.z32.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bovurozef.z32.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054014907600052720"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4392f258-a255-5a02-a14d-b41d04f1ce4c","created":"2026-05-12T02:00:00.000Z","modified":"2026-05-12T02:00:00.000Z","valid_from":"2026-05-12T02:00:00.000Z","name":"kocaelii.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kocaelii.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054018759610823045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc72eac-3cd6-5a3e-a84c-433029384b57","created":"2026-05-12T02:00:00.000Z","modified":"2026-05-12T02:00:00.000Z","valid_from":"2026-05-12T02:00:00.000Z","name":"https://kocaelii.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kocaelii.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054018759610823045"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6a435c-d858-5160-820b-5f8ce3130c62","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"pozeny.shop","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pozeny.shop']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edce41e-67e8-519e-a43b-064544132990","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"http://pozeny.shop/mart/res/bb.php","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pozeny.shop/mart/res/bb.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2285714f-834a-5bda-bcb9-e2f39e4b1a26","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"731d96ba17bd5714bba1f4f1dbfa0d1487fe2f54ff20bfdc64d4502538c3d587","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '731d96ba17bd5714bba1f4f1dbfa0d1487fe2f54ff20bfdc64d4502538c3d587']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70a7f92e-7ae0-5111-9113-7014820d5bdb","created":"2026-05-12T02:43:00.000Z","modified":"2026-05-12T02:43:00.000Z","valid_from":"2026-05-12T02:43:00.000Z","name":"0ce1d8a47fc78ac53c0b62bed96b20fa721e3e39115a6248d55100eb01eafff1","description":"IOC reported by @G60930953 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0ce1d8a47fc78ac53c0b62bed96b20fa721e3e39115a6248d55100eb01eafff1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/G60930953/status/2054029601408479514"}],"labels":["DPRK"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16ac6e0e-2944-52be-9a70-7e24d59e0339","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"https://83.142.209.194/transformers.pyz","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://83.142.209.194/transformers.pyz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd6e903e-ec3d-58f9-9b70-51fd792eae44","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"http://83.142.209.194","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://83.142.209.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--70e399df-2b50-5a98-aee7-afafedf2ad67","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"pgmonitor.py","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pgmonitor.py']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3240659-975f-5100-a917-3b921a9b833b","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"http://pgmonitor.py","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pgmonitor.py']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd5816a0-8e9f-5bc7-a346-a6d0594a9777","created":"2026-05-12T03:30:00.000Z","modified":"2026-05-12T03:30:00.000Z","valid_from":"2026-05-12T03:30:00.000Z","name":"83.142.209.194","description":"IOC reported by @MsftSecIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '83.142.209.194']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MsftSecIntel/status/2054041471280423424"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55cd4ee-c032-5b90-8731-13213ddf9958","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1d5578a-d84a-5c58-940d-790cc655c850","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"https://maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://maryinternaldoc9c909448f0c5048b466d4030f0989544.gracesabagricbusiness.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb50fac3-b481-5703-b91e-698c224c43d9","created":"2026-05-12T03:36:00.000Z","modified":"2026-05-12T03:36:00.000Z","valid_from":"2026-05-12T03:36:00.000Z","name":"18a3dd7ab5a6cc31bf15d048e519d05b0a569ee5d4595ac6d6abdfdc4d456e94","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '18a3dd7ab5a6cc31bf15d048e519d05b0a569ee5d4595ac6d6abdfdc4d456e94']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054042981045522604"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d35a63-a104-5743-8d43-22ceeffe7baf","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d530dab0-40b6-5c2d-b1da-2bec2778e968","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"https://pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pamelarecordzcbb43de84659d691b441405b2a778b61.westernminingghana.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a32a41d-2b53-592a-bbcf-40b3b1f7af45","created":"2026-05-12T03:42:00.000Z","modified":"2026-05-12T03:42:00.000Z","valid_from":"2026-05-12T03:42:00.000Z","name":"8a9ec228c1b1cedf445b2751036b4ef50f2a5a68932996bea373d586f3b2d5cf","description":"IOC reported by @patialavii on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a9ec228c1b1cedf445b2751036b4ef50f2a5a68932996bea373d586f3b2d5cf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/patialavii/status/2054044515875614737"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02173ec9-8887-5db0-868b-1c6164a1da7f","created":"2026-05-12T04:00:00.000Z","modified":"2026-05-12T04:00:00.000Z","valid_from":"2026-05-12T04:00:00.000Z","name":"yahoostorage.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'yahoostorage.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054048973661376717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b351ae3f-d9e4-5196-bddf-587cbb5c002a","created":"2026-05-12T04:00:00.000Z","modified":"2026-05-12T04:00:00.000Z","valid_from":"2026-05-12T04:00:00.000Z","name":"https://yahoostorage.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://yahoostorage.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054048973661376717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7035da5c-f6f9-506f-89d8-292de6ca828c","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"dsrzzi.jetgq.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsrzzi.jetgq.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7695193-008b-5d2c-a0a1-5d33f68909be","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"https://dsrzzi.jetgq.cn/jkautixtf/londut/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsrzzi.jetgq.cn/jkautixtf/londut/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5e91e1-b504-59fc-9a8d-41f21c788a10","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"http://165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-12T04:10:00.000Z","modified":"2026-05-12T04:10:00.000Z","valid_from":"2026-05-12T04:10:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054051592132039100"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59d1f19c-72a0-54f2-97af-aa6502ed3396","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"ifajiabang.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ifajiabang.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb382900-6b26-5cab-b2a1-a328133b2c64","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"https://ifajiabang.com/dca3ei/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ifajiabang.com/dca3ei/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--855b720a-02a6-5c69-b931-af2e2a3f6731","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"http://43.153.186.198","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.153.186.198']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0c7a81-d27d-5224-80b6-01550df17662","created":"2026-05-12T04:23:00.000Z","modified":"2026-05-12T04:23:00.000Z","valid_from":"2026-05-12T04:23:00.000Z","name":"43.153.186.198","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.153.186.198']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054054788959199336"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da8abc-989e-5b37-9f57-f2cf025a62dd","created":"2026-05-12T04:34:00.000Z","modified":"2026-05-12T04:34:00.000Z","valid_from":"2026-05-12T04:34:00.000Z","name":"rqvzkqb.shbllgs.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqvzkqb.shbllgs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054057602485792854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b621dc-1602-50ed-ac69-2fd26b0a16fe","created":"2026-05-12T04:34:00.000Z","modified":"2026-05-12T04:34:00.000Z","valid_from":"2026-05-12T04:34:00.000Z","name":"https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054057602485792854"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca95f41e-5508-54e3-b4b5-38c9e0ad8bfd","created":"2026-05-12T04:39:00.000Z","modified":"2026-05-12T04:39:00.000Z","valid_from":"2026-05-12T04:39:00.000Z","name":"kylesplumbing.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kylesplumbing.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054058738064269677"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b04b2b7b-3891-55e1-8ffe-c3860d869c1e","created":"2026-05-12T04:39:00.000Z","modified":"2026-05-12T04:39:00.000Z","valid_from":"2026-05-12T04:39:00.000Z","name":"http://kylesplumbing.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kylesplumbing.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054058738064269677"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fe77b96-cfa2-560e-8bbc-8c7afea061c4","created":"2026-05-12T05:10:00.000Z","modified":"2026-05-12T05:10:00.000Z","valid_from":"2026-05-12T05:10:00.000Z","name":"https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-50417","description":"IOC reported by @fr0gger_ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-50417']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fr0gger_/status/2054066540551778529"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e3c1f6d-bd4c-5c1b-8b36-7b68d10aef2e","created":"2026-05-12T05:10:00.000Z","modified":"2026-05-12T05:10:00.000Z","valid_from":"2026-05-12T05:10:00.000Z","name":"https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-504171770249968","description":"IOC reported by @fr0gger_ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://blackhat.com/us-26/training/schedule/#practical-genai-for-threat-intel-real-world-agentic-workflows-for-cyber-threat-intelligence-504171770249968']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/fr0gger_/status/2054066540551778529"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3a5ff1-fdee-526b-a136-46df78ca9b78","created":"2026-05-12T06:00:00.000Z","modified":"2026-05-12T06:00:00.000Z","valid_from":"2026-05-12T06:00:00.000Z","name":"mail-organized-update.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mail-organized-update.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054079185123999945"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b305ed0-85cf-5f13-a286-01dfeb81edfc","created":"2026-05-12T06:00:00.000Z","modified":"2026-05-12T06:00:00.000Z","valid_from":"2026-05-12T06:00:00.000Z","name":"https://mail-organized-update.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mail-organized-update.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054079185123999945"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29cbb620-560d-5e3d-bb56-b32135e9a260","created":"2026-05-12T06:07:00.000Z","modified":"2026-05-12T06:07:00.000Z","valid_from":"2026-05-12T06:07:00.000Z","name":"seur-cdefg.vip","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'seur-cdefg.vip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054081103435084151"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d1e2391-2ffe-5c50-bedc-830475e19789","created":"2026-05-12T06:07:00.000Z","modified":"2026-05-12T06:07:00.000Z","valid_from":"2026-05-12T06:07:00.000Z","name":"http://seur-cdefg.vip","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://seur-cdefg.vip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054081103435084151"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dd04e70-7d1f-59f5-bed1-7d9ce5693a69","created":"2026-05-12T06:21:00.000Z","modified":"2026-05-12T06:21:00.000Z","valid_from":"2026-05-12T06:21:00.000Z","name":"45.227.254.10","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.227.254.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054084551589106071"}],"labels":["NetSupport","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19443961-6eef-5fad-853b-46386e428584","created":"2026-05-12T06:21:00.000Z","modified":"2026-05-12T06:21:00.000Z","valid_from":"2026-05-12T06:21:00.000Z","name":"483d16bbbb25c1d0e2c05000ef8a72c3","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '483d16bbbb25c1d0e2c05000ef8a72c3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054084551589106071"}],"labels":["NetSupport","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bde668c-f476-5829-b924-acbba505a667","created":"2026-05-12T06:59:00.000Z","modified":"2026-05-12T06:59:00.000Z","valid_from":"2026-05-12T06:59:00.000Z","name":"147.45.45.238","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '147.45.45.238']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054093972004311110"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7110661c-3de4-524e-a96a-305d3b2cacb1","created":"2026-05-12T06:59:00.000Z","modified":"2026-05-12T06:59:00.000Z","valid_from":"2026-05-12T06:59:00.000Z","name":"95.85.246.53","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '95.85.246.53']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054093972004311110"}],"labels":["ClickFix","NetSupport","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3064f28-246e-5784-8e6c-09f1a064f23d","created":"2026-05-12T07:34:00.000Z","modified":"2026-05-12T07:34:00.000Z","valid_from":"2026-05-12T07:34:00.000Z","name":"apartuk.info","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apartuk.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054102910099759562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f72f201-3d8b-5b2d-ad3a-6b2f45ecf620","created":"2026-05-12T07:34:00.000Z","modified":"2026-05-12T07:34:00.000Z","valid_from":"2026-05-12T07:34:00.000Z","name":"http://www.apartuk.info/hpum/index.php?account=w4naf290","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.apartuk.info/hpum/index.php?account=w4naf290']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054102910099759562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--46ea6e2a-9dd7-5328-a1c6-d78290d4a05a","created":"2026-05-12T07:41:00.000Z","modified":"2026-05-12T07:41:00.000Z","valid_from":"2026-05-12T07:41:00.000Z","name":"fazexmd.com","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'fazexmd.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2054104731090293040"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b2ae262-aad0-5fec-9bea-6253ad83ca6c","created":"2026-05-12T07:41:00.000Z","modified":"2026-05-12T07:41:00.000Z","valid_from":"2026-05-12T07:41:00.000Z","name":"https://fazexmd.com/wordpress/fark/","description":"IOC reported by @ShadowOpCode on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://fazexmd.com/wordpress/fark/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/ShadowOpCode/status/2054104731090293040"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--086521e2-2909-565b-8241-ba6ecb7d2c0f","created":"2026-05-12T08:00:00.000Z","modified":"2026-05-12T08:00:00.000Z","valid_from":"2026-05-12T08:00:00.000Z","name":"eharmonyesec.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'eharmonyesec.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054109372112892340"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d608b0a8-c1ba-5418-a2cb-6c2b9a90f197","created":"2026-05-12T08:00:00.000Z","modified":"2026-05-12T08:00:00.000Z","valid_from":"2026-05-12T08:00:00.000Z","name":"https://eharmonyesec.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://eharmonyesec.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054109372112892340"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fee105-b3d9-5d2a-9934-869c1d1ea67c","created":"2026-05-12T08:14:00.000Z","modified":"2026-05-12T08:14:00.000Z","valid_from":"2026-05-12T08:14:00.000Z","name":"e-stat.online-k1.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-k1.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054113088534880473"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--03330e5d-5cda-551f-9bf1-316ce3186522","created":"2026-05-12T08:14:00.000Z","modified":"2026-05-12T08:14:00.000Z","valid_from":"2026-05-12T08:14:00.000Z","name":"https://e-stat.online-k1.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-k1.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054113088534880473"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3c1f145-e03c-509c-9a6d-9f0117f4a20d","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"873e628f5d558feb47af978f1c076903","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '873e628f5d558feb47af978f1c076903']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--56a9ad03-f00f-55ab-b546-fe6f72411f33","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"58e5e9a7ef509920b05253aa806422fa","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '58e5e9a7ef509920b05253aa806422fa']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--00147480-81d5-513e-afec-4fd7a04cfcc7","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"bdb677e209c25ee4839bfa3011bf4d96","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'bdb677e209c25ee4839bfa3011bf4d96']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bb704689-d4ee-53e4-9b9f-8cecd655d267","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"73f859fe238fdd687736ed2039e1d61d","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '73f859fe238fdd687736ed2039e1d61d']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a1f3e15-9065-5674-8270-45db48e3896b","created":"2026-05-12T08:25:00.000Z","modified":"2026-05-12T08:25:00.000Z","valid_from":"2026-05-12T08:25:00.000Z","name":"9ca07ab3525782b35ec7b4a9c931fe88","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '9ca07ab3525782b35ec7b4a9c931fe88']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054115743097311540"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--653be9c6-a4c5-5b4d-afb1-37d607d2feb6","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://telegra.ph/tr02-05-02","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://telegra.ph/tr02-05-02']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--15dba67d-3342-5928-85e4-c3e49a7b9d9f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://telegra.ph/ki06-05-02","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://telegra.ph/ki06-05-02']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a292478-f187-5e8f-a1ba-94bc92984e49","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"rentry.co","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rentry.co']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8b83f97-45d5-5ef1-804c-2313d0204248","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://rentry.co/zzk7opdu","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rentry.co/zzk7opdu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a68c1eb-3a0b-5e4c-8a67-f296b3438419","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"rentry.org","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rentry.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8285cb69-8a49-5c16-bf53-5290c2e9edbd","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://rentry.org/wayc2qqz","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rentry.org/wayc2qqz']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42a3b89f-bacb-5a14-8600-b3f7b5542c0f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"codeberg.org","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'codeberg.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--430ae76f-f9c8-5770-b78c-c7544dee435f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"https://codeberg.org/etienne74/guix/raw/branch/master/.gitignore","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://codeberg.org/etienne74/guix/raw/branch/master/.gitignore']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6e7d768-e9fd-5854-9910-e95697c2c1f8","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c79a7bcc-57e1-56a7-85c4-0dfc7892b948","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion/t","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://2wxjoz6lkdxkniksujbdknkugweemx7uvxdr4ejgyipce4tnvktvbvqd.onion/t']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1306a374-9eca-55e4-84f0-88e20752e6f8","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"parkspringshotel.com","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'parkspringshotel.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be52888c-bc83-5877-b7a7-5e7c1fbc031e","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://parkspringshotel.com/m/Lu6aeloo.php","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://parkspringshotel.com/m/Lu6aeloo.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29c12a15-30a2-5de8-9fa7-6a28eac51b29","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"auraguest.lk","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'auraguest.lk']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee1e5ea-f578-5241-8ce3-6ae6f155422d","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"http://auraguest.lk/m/douV2quu.php","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://auraguest.lk/m/douV2quu.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e50d2283-00fd-5a8b-b3b3-f68957b0325f","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"172.96.172.91","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.96.172.91']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce053f90-e1b8-5fe3-8ab7-de94e3794c3a","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"209.133.215.178","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '209.133.215.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a426da-cbac-58a0-bcd4-9e5953c5592d","created":"2026-05-12T08:42:00.000Z","modified":"2026-05-12T08:42:00.000Z","valid_from":"2026-05-12T08:42:00.000Z","name":"c81d723205a25d4cb8bab7b31889623edf5f7e94d63df0d224225b566864cec2","description":"IOC reported by @thomasklemenc on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c81d723205a25d4cb8bab7b31889623edf5f7e94d63df0d224225b566864cec2']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/thomasklemenc/status/2052715025450598904"}],"labels":["RAT","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1913680b-582a-5b55-bf08-002cb37418bb","created":"2026-05-12T09:13:00.000Z","modified":"2026-05-12T09:13:00.000Z","valid_from":"2026-05-12T09:13:00.000Z","name":"45387425929d60b59f8d06c1c07f3e399eac8c5289f234bb5a26912509266fd0","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '45387425929d60b59f8d06c1c07f3e399eac8c5289f234bb5a26912509266fd0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054127872173019157"}],"labels":["APT","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1e84bd1-fb18-591a-8652-be0ff58582b7","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"zinixpro.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zinixpro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad9b3e20-ceba-5776-b2a1-e1d66bb1aa95","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"http://zinixpro.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://zinixpro.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--60f88661-90cc-500b-8fc4-1aa20bff95f1","created":"2026-05-12T09:17:00.000Z","modified":"2026-05-12T09:17:00.000Z","valid_from":"2026-05-12T09:17:00.000Z","name":"604b9636828b9fa4e65b3378a8af65c1035ba9905a72a64b760a9541694aae1c","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '604b9636828b9fa4e65b3378a8af65c1035ba9905a72a64b760a9541694aae1c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054128749310841345"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--96088178-a205-5756-8f65-265ab1592f35","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"kollins.co.za","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kollins.co.za']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--db6e3c1f-688c-5c78-9689-af8c62820350","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"http://kollins.co.za/bn.js","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kollins.co.za/bn.js']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fb3d793f-2359-5cc4-a672-526bcb3a12db","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"http://kollins.co.za/test.pdf","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kollins.co.za/test.pdf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3000433-64f7-57db-bb31-bbcd347c2b3a","created":"2026-05-12T09:20:00.000Z","modified":"2026-05-12T09:20:00.000Z","valid_from":"2026-05-12T09:20:00.000Z","name":"5eb9c0577c817e6053ed0658b20e97e0f60077df817f68462ed1f3b243bc0572","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '5eb9c0577c817e6053ed0658b20e97e0f60077df817f68462ed1f3b243bc0572']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054129672888127979"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8a46760-dcc5-522b-89d7-6d791b1c2a65","created":"2026-05-12T09:22:00.000Z","modified":"2026-05-12T09:22:00.000Z","valid_from":"2026-05-12T09:22:00.000Z","name":"0de9cc3daa4dc11053c6b43635355c95b6f51f19f617764efb0e0f2729d01e91","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0de9cc3daa4dc11053c6b43635355c95b6f51f19f617764efb0e0f2729d01e91']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054130180021510571"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--fae2ef7a-8ad1-5f1e-b7f4-3b3148f65409","created":"2026-05-12T09:48:00.000Z","modified":"2026-05-12T09:48:00.000Z","valid_from":"2026-05-12T09:48:00.000Z","name":"git-tanstack.com","description":"IOC reported by @SocketSecurity on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'git-tanstack.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SocketSecurity/status/2054048025081737446"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5b161b21-c487-5043-aa91-aee92e4dba6a","created":"2026-05-12T09:48:00.000Z","modified":"2026-05-12T09:48:00.000Z","valid_from":"2026-05-12T09:48:00.000Z","name":"http://git-tanstack.com/transformers","description":"IOC reported by @SocketSecurity on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://git-tanstack.com/transformers']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/SocketSecurity/status/2054048025081737446"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8e8b0b87-034f-5b1f-977d-8c5a3fd61458","created":"2026-05-12T09:52:00.000Z","modified":"2026-05-12T09:52:00.000Z","valid_from":"2026-05-12T09:52:00.000Z","name":"76c19e4e9e4d24ea1e5a7b795ac6301093f59c15bea4a72f0daa5cda312424ae","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '76c19e4e9e4d24ea1e5a7b795ac6301093f59c15bea4a72f0daa5cda312424ae']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054137739826835823"}],"labels":["infostealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c8ea862-a0e4-5cb7-bd36-86f8cef7ff62","created":"2026-05-12T10:00:00.000Z","modified":"2026-05-12T10:00:00.000Z","valid_from":"2026-05-12T10:00:00.000Z","name":"program-shopee22.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'program-shopee22.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054139593369309196"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14d1c490-f0e2-5880-beb7-92dc71fb1344","created":"2026-05-12T10:00:00.000Z","modified":"2026-05-12T10:00:00.000Z","valid_from":"2026-05-12T10:00:00.000Z","name":"https://program-shopee22.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://program-shopee22.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054139593369309196"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b65a164-65b7-5e77-bf77-20b8224943ab","created":"2026-05-12T10:27:00.000Z","modified":"2026-05-12T10:27:00.000Z","valid_from":"2026-05-12T10:27:00.000Z","name":"illuminanceglobal.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'illuminanceglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054146443292578269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6707477-b12a-57f7-b679-b11618081593","created":"2026-05-12T10:27:00.000Z","modified":"2026-05-12T10:27:00.000Z","valid_from":"2026-05-12T10:27:00.000Z","name":"https://illuminanceglobal.com","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://illuminanceglobal.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054146443292578269"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04680c81-d96e-5f7e-a5c6-80df09abdc5c","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"njifjuhgh.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'njifjuhgh.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b96b2b28-85d6-50de-9dc0-7249cb1fa481","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"http://njifjuhgh.top","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://njifjuhgh.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7503b3e9-48c0-57b3-8f85-a8799c98f7ee","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"7263622822694fc8c2720974c31b5c12b2fdc864ce496ab4f6da57e8c361b59b","description":"IOC reported by @Malwarehunterr on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '7263622822694fc8c2720974c31b5c12b2fdc864ce496ab4f6da57e8c361b59b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Malwarehunterr/status/2054156236883714493"}],"labels":["malware","phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3696b917-78bf-56da-84c0-d41e418bd773","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"http://157.230.222.44/payload.php","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://157.230.222.44/payload.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--82cd6737-5b44-5824-be31-4dbea33f1a15","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"157.230.222.44","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '157.230.222.44']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--13cc8247-5a5c-58e3-ab9b-3c120329e28c","created":"2026-05-12T11:06:00.000Z","modified":"2026-05-12T11:06:00.000Z","valid_from":"2026-05-12T11:06:00.000Z","name":"904cee0e70cf6625790b9355993a02d41f88f21ab5ab376f6c08aae649c5fad0","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '904cee0e70cf6625790b9355993a02d41f88f21ab5ab376f6c08aae649c5fad0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054156317858693553"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--953fb54f-7c69-5a87-8fd6-275bdfde64fb","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 's-0s23dlg1u8lo.s3.us-east-2.amazonaws.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3883d82f-a0b8-58e0-9ffd-596de481cae8","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"https://s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com/Mone.msi","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://s-0s23dlg1u8lo.s3.us-east-2.amazonaws.com/Mone.msi']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa5a9c44-35fb-5dd1-a513-0ad6af0f1106","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"7ad98274c5b35f178aa65fc75c1ba675","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '7ad98274c5b35f178aa65fc75c1ba675']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc4c5e8e-2b3e-5c2a-be3f-94aab54e3dde","created":"2026-05-12T11:22:00.000Z","modified":"2026-05-12T11:22:00.000Z","valid_from":"2026-05-12T11:22:00.000Z","name":"d6c89a7d313aca48f9ac787d27447234","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'd6c89a7d313aca48f9ac787d27447234']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054160220021215496"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--140cb308-df2a-5c3e-a4d3-08796aeed1cc","created":"2026-05-12T12:00:00.000Z","modified":"2026-05-12T12:00:00.000Z","valid_from":"2026-05-12T12:00:00.000Z","name":"skymailups.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'skymailups.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054169777669566646"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--496ef5b9-5d2e-5fe9-b90e-16d7d62497fa","created":"2026-05-12T12:00:00.000Z","modified":"2026-05-12T12:00:00.000Z","valid_from":"2026-05-12T12:00:00.000Z","name":"https://skymailups.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://skymailups.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054169777669566646"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f18673d3-8632-5c5a-b821-6cecf66ba464","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"macspaceclean.framer.ai","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'macspaceclean.framer.ai']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c178322-ebd0-5364-bfe7-e8c3f7b33c8d","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"http://macspaceclean.framer.ai","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://macspaceclean.framer.ai']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a7fdc1-f4e2-5794-aa0b-db2c0d3e1126","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"landishivpole.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'landishivpole.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dd93b8ea-9cda-5771-b269-a93e46a433b6","created":"2026-05-12T13:40:00.000Z","modified":"2026-05-12T13:40:00.000Z","valid_from":"2026-05-12T13:40:00.000Z","name":"http://landishivpole.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://landishivpole.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054195051551687069"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed55121f-6af0-5cff-92cf-fe81f5674f80","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-con.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-con.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fd4d76a8-ca83-5894-99f0-89008b10aa29","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-con.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-con.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12ca8fe0-ac2b-52f0-8813-1cce5fc36a3e","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-coc.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-coc.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dae99bf2-f331-5943-9de3-c10c092d8f23","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-coc.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-coc.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c42cf84-6630-5257-bf82-54f8196e8d1d","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"kw-com.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kw-com.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12774546-4262-5fc7-9da4-22212c16e092","created":"2026-05-12T14:18:00.000Z","modified":"2026-05-12T14:18:00.000Z","valid_from":"2026-05-12T14:18:00.000Z","name":"http://kw-com.cyou","description":"IOC reported by @Q8CyberTi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://kw-com.cyou']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Q8CyberTi/status/2054204615088837105"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c6e0286-b49f-5163-bbb8-ded24d90f064","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40025a86-7d42-5724-ab37-bfd162becacd","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"http://youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://youngest-black-lsm7dke7zn-70r72xpafy.edgeone.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e0fe137-202e-51f4-a0e4-b6cacfbb2cfd","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"http://43.152.26.58","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://43.152.26.58']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6558c6b5-3029-5912-8387-65b65e695e00","created":"2026-05-12T15:04:00.000Z","modified":"2026-05-12T15:04:00.000Z","valid_from":"2026-05-12T15:04:00.000Z","name":"43.152.26.58","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.152.26.58']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054216226621276544"}],"labels":["C2","stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7415813e-d298-59b7-9709-11cdeefc8a91","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://157.230.222.44","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://157.230.222.44']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7916437a-0e83-5a2c-8a0f-0e90a19c2ae7","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://162.141.111.227","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://162.141.111.227']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--06cfb4fd-e83f-5f9d-8d0a-b295d00a41cd","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://177.54.150.13","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://177.54.150.13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cb66bf8-6bb7-5cb0-9ec1-18cbe37be397","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.235","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.235']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9228348f-81aa-5dc0-ba49-478b770d3018","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.242","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.242']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53fdcbbf-4acb-5e65-a3eb-b86f3bbcbafa","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--91f2c57c-1808-5dee-ae0e-d572d9315c4b","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://37.148.135.245","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://37.148.135.245']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba4f3b00-7971-54a4-b776-cf54d1fd3493","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://162.141.111.227:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://162.141.111.227:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b1d06e6-6f98-56d4-a626-2e1d72d324da","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://177.54.150.13:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://177.54.150.13:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6fd75c7f-fb62-547d-9fe4-d8db8add2b26","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.235:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.235:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--32122758-6d79-53d4-af58-1a7e815b64c0","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://181.214.221.242:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://181.214.221.242:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--364d272c-b315-5927-9ec4-cbfb386a9736","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40:6000","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:6000']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--184625f6-a234-55de-b2c0-8935b23a07ec","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"http://200.9.155.40:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d71e966-fbd2-55fc-8093-61e7b51b90e2","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"162.141.111.227","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '162.141.111.227']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--869e7c72-7520-53aa-a098-3eca345f0a55","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"177.54.150.13","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '177.54.150.13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9c57ded-02da-5f33-88eb-0f08e3fd3890","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"181.214.221.235","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.235']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ce37a35-19e4-54a5-8ac1-83629027ff36","created":"2026-05-12T15:12:00.000Z","modified":"2026-05-12T15:12:00.000Z","valid_from":"2026-05-12T15:12:00.000Z","name":"181.214.221.242","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '181.214.221.242']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218220576407854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--27dc4c8f-9bbd-581b-92bb-9f519288aaf4","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://200.9.155.40:8081","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8081']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--60586ff7-abea-5f54-af61-a7201b524bea","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://200.9.155.40:8888","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://200.9.155.40:8888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e1457a6-7855-58ee-8af7-35ef13879d5b","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://37.148.135.245:443","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://37.148.135.245:443']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b46935c-4726-5669-9c62-39badaeffa4c","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"cdn-relay.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cdn-relay.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--20fe6d53-36de-513d-a931-4b013f099ab7","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://cdn-relay.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cdn-relay.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0d72c9a-7e97-5439-a6d3-a580ca85c645","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e861e87-b24b-5913-ad62-15a3d54a690c","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffc91074-3a3f-550e-949f-a9082b0c6e96","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c53aeca0-5744-5e7e-9f63-7b75afbdfa8f","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ebf93eda-c285-5820-a8d0-52fc0830e54d","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8ffb1d6-6f22-56b8-9a9f-c9f6fff391ec","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df9c51f-5a7e-5d82-989b-207bc0e15e12","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"c.windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c.windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed5f0600-806c-57d5-8261-7008e4be5822","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://c.windowlp-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c.windowlp-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6862914-480b-52f0-8872-09054833ca98","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"c.windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c.windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--44be9286-205b-53ce-ac82-becf58338d45","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://c.windowsk-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://c.windowsk-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa8c68c7-e024-5272-9c62-d41596095f73","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"uniplus.cktech.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uniplus.cktech.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--95212223-08f8-588e-964c-d732df9985e1","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://uniplus.cktech.info","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uniplus.cktech.info']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bdcc0546-38a5-5b5a-81f5-9667d44a10b6","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"wss.windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wss.windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--243a7bf3-b02a-5c78-bda2-e8cf6cec3547","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"http://wss.windowsupdate-cdn.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://wss.windowsupdate-cdn.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c0ba73e-945e-59e3-baf1-b9ee10997938","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"200.9.155.40","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '200.9.155.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3f01617-115c-53d2-a0ec-4ed9feb5b938","created":"2026-05-12T15:13:00.000Z","modified":"2026-05-12T15:13:00.000Z","valid_from":"2026-05-12T15:13:00.000Z","name":"37.148.135.245","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '37.148.135.245']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054218319931064736"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--79169fdc-558a-55bb-ae05-d0f9fc1e9fee","created":"2026-05-12T16:00:00.000Z","modified":"2026-05-12T16:00:00.000Z","valid_from":"2026-05-12T16:00:00.000Z","name":"luuizpaes.github.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'luuizpaes.github.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054230163106238717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66d607e2-68cc-5afb-8bd2-10ff6956359f","created":"2026-05-12T16:00:00.000Z","modified":"2026-05-12T16:00:00.000Z","valid_from":"2026-05-12T16:00:00.000Z","name":"http://luuizpaes.github.io/netflix-page/","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://luuizpaes.github.io/netflix-page/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054230163106238717"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd3697e9-822e-5709-8339-d39c3cd891e3","created":"2026-05-12T18:00:00.000Z","modified":"2026-05-12T18:00:00.000Z","valid_from":"2026-05-12T18:00:00.000Z","name":"kucoinlogiu.gitbook.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kucoinlogiu.gitbook.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054260375277769135"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d87b783-e8da-57bc-89d4-a528b9450a2d","created":"2026-05-12T18:00:00.000Z","modified":"2026-05-12T18:00:00.000Z","valid_from":"2026-05-12T18:00:00.000Z","name":"https://kucoinlogiu.gitbook.io","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kucoinlogiu.gitbook.io']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054260375277769135"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f59fbe8-27c1-5b56-89ac-d2f60993ebe3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npchannel25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npchannel25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--32b7b7f5-ec06-5527-87b1-14aaf07c142f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npchannel25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npchannel25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f59195-c7ef-5698-a80e-d2d3283bd1eb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc13s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc13s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11cf9a31-d74b-5102-97af-7d4ce3b5075d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc13s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc13s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d751c8f-9717-56e9-afdf-4ff98746cddf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80219a0b-4626-5df9-b62b-d544f879182a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89366d60-6af4-51bb-a57f-65df8ceabb00","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a379124a-08c3-5672-9c6d-45f2b87e4559","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d489c45-d235-5fba-a856-372cb979517b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f262b563-b71f-56d4-ac18-69975b6ce27f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--129cae1a-ec24-5ea6-a6ee-22616bbca7af","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4154065f-d0db-5b6b-89dc-791deede27ef","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.npload-mdoc12s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.npload-mdoc12s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81aeca73-d56f-5b5e-ada1-1b2e4e180359","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--493b44d1-4571-51f8-98c1-40fc9d1e90a5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b58aaba-384e-5e01-9ca3-052a70c6f8fe","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b25637bb-a541-5ae8-85ba-c27ba97c60a9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--21852d26-298b-531c-b732-c2515614a241","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e54625d-841b-5c2b-8685-cd10e389c008","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.nrec-taxdoc19s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nrec-taxdoc19s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63071d23-6193-5b57-9a59-c76444a1fa8c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--74774c43-73ea-5f96-ac7d-2041a50a972f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.nrec-taxdoc10s.yyuyy.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.nrec-taxdoc10s.yyuyy.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d52563fb-9114-53c2-96ee-6cfc96ee9c6e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc45s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc45s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e978cb41-3c00-5003-87e8-c9676818f1b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc45s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc45s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f09d477-643d-51e2-9493-45f7efd19b86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83f78d6e-47f3-5e60-9d6d-febde04cb3a6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f59562d1-df9f-5e18-a504-1675de424149","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc49s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc49s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a9b5481-39f6-5b92-95a1-08e2fe5ab973","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc49s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc49s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36d6795d-1c8e-5691-9b74-16f72ac3801c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4b6e23e-6d90-5a47-8f8a-8ce315e5d37b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cd7d46b-2641-5843-b127-70da7f2addc2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc87s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc87s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91bfdf1c-dc50-5419-89f9-1b810c76d445","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc87s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc87s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8a156f1-08a6-5a63-baad-d8cd7b75f3d1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dbdffd21-9a10-53ce-a877-d154bf4e6734","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f736e38c-7aee-5170-b6cc-8a9b50ce8f9f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23545a31-37d6-5f29-bf9a-0c398863b8c7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc62s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc62s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--01bae8cc-7fcb-5a4c-b488-31046a4c4802","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc30s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc30s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--baf22dd0-18be-5ffa-b79f-9d5abebef23a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc30s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc30s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0cf72b18-82aa-56f5-b857-33ec4614ef73","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d324f15b-3532-5124-8ba1-fcee519c1589","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47a3e773-072f-5d73-b785-adca547519fa","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc72s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc72s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4990641-5f69-57d8-a391-2e29421b8a25","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc72s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc72s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4742b55-d7cf-5e05-801a-3f315665f5a6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntkeep-udoc51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntkeep-udoc51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8fc7428-5eb2-5ac0-ad10-98b3178de50f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntkeep-udoc51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntkeep-udoc51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23dda3ca-ec87-5f5a-a958-c1d2d6473ff6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--318481af-59a5-54c3-b3d3-e7ca2e02ccfc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da762423-c1d6-530d-a31a-0cf2f63b9c0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nlmsuser5doc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nlmsuser5doc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5d1b97d-05ef-56cd-af46-311060c9de48","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nlmsuser5doc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nlmsuser5doc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50fa2e2a-45ec-5239-a8ec-bb898fcb4473","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59585c26-4b01-52d6-9172-071a12e2801f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc39s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc39s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffd108ec-928f-5ea6-a63b-45df2b8fb747","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2dcf018-89a3-50f2-a545-94472d6de1c1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid68s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid68s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b88af220-1602-5c9d-b273-4ff1f72a923c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f2db76d-2b60-51fe-a6dd-478eb165b3ed","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05968b06-c39e-5bec-8daa-583e47127348","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eac63944-6fb1-5a7b-83e2-f2c2d4638f0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea1a2219-41f0-5a81-ae47-07f2e346a0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2148d23-7bf2-5506-a830-42723d6ec9f9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6abc8821-0869-588e-89bb-0549b7d8718f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d5d1b99-d8dc-5530-92b7-00e92cd2a332","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--702d31f9-3109-5dc2-9d89-d100ba1a0758","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm10v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm10v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--91d43eca-78b1-5723-956c-d1fef76f44c2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm10v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm10v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2bf4245-435e-52e9-83dc-87e952afcf26","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--030e981a-2ab9-574b-bf40-f3bfd7125d4a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6d034fe-caee-5cd4-80bb-2b2b58e8c32e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e625e3-41c3-502c-96a1-7ae12b274422","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1f07625-87fe-56dc-a6d9-cfc9c8029651","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf5b0f55-39d3-53d6-994e-4b0f35187cda","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.usernps-mid21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.usernps-mid21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--593ba1e9-370a-5183-8bf8-7b6bb9450cb8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-53v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-53v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4a3e72c-23a5-5f75-b57a-6f631ef6e2f9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-53v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-53v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82249a36-5fe3-5518-bf09-45b48797267e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18339bc6-7cf3-5fbd-bb3b-89c79b654975","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f058c0d6-4d38-5aa9-9d64-9cbf7ff731e9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37e5c17b-9dcf-5199-b540-be2fb2818679","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a1ce473-988e-510d-af05-48b1a83b0ab9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b0396e0-c035-5cb4-83c8-df7dc6cf9e38","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk95s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk95s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c69886f9-d281-51cd-9451-d16510261f44","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05ad595e-e3d3-572e-a7da-6c1c8106badd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d62s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d62s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d93fc6-12fb-5bea-95a6-672723bcb0c7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ae1e3e9-3680-57d7-9ab4-9c492fc2d2be","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3eebbe1d-7e8e-5009-9d36-e3bd9c2d6924","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a87ae92d-79ac-5613-ab7d-4e15305743f5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e628dc9-3559-5a19-b124-eb8afa458b0f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac6f2be5-7e35-5f0c-bcc1-437001ff80ff","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d49s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d49s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fb0e7a9-db01-5349-92a3-ddfdc5ae8071","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f5907be-3ebd-51a8-8b0a-a33853090edf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice3s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice3s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76f48c4b-1811-538b-9c52-28ddbe6f841e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10339404-9ec7-548d-ac3a-7bfd02c18101","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice11s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice11s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8c415d-8ffa-5ace-a118-42f4e5aa4ee3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02cc4820-48e3-5f5f-9e24-78e2f68579a2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26390f16-75b5-54af-81a9-48a36bcdb0b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol3s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol3s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fce95b9f-ba37-5c07-97b6-9c33f70c2879","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol3s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol3s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fab18e85-9c24-50d8-9df7-6a8fb9671862","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62a95916-57a2-57b1-9bbc-90e6e417e4b3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62b94d13-3f2c-562b-8661-e3a03a09837f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61394b61-3a8a-54ce-8122-0f0fb4f91daf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice12s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice12s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea093949-ec87-52cc-ad5b-555e0c5a0a9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--160e1bee-c21b-5dcf-9c0a-260018d497cf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice13s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice13s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c57a1766-23a1-536a-90f2-6f84905b03ae","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b731a9fd-291d-5c44-969a-31c46b5736ca","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b759659-61c2-5966-a233-53cca3d8979f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc522080-7cad-5c8b-aa5d-af67b1e685f7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7ac03b5-a28d-5415-844e-6e193ec5d41f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a96995b-dc2e-56a2-92f5-7ec2fde9618e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ae7474e-1f11-5de7-b1d3-613691bb02a3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm34s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm34s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1012f71-6db1-573b-8208-64225bc019d4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm34s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm34s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ee788fa-cb3d-5ea5-931c-e8726207a521","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0a0d990-7172-5573-9d10-380b119f5d4a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa08d415-9ed2-58fa-a192-b5a8450e94c4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf047296-4d9f-518a-9a28-749d3467d7cb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice90s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice90s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fce42b7-ee86-57e5-95fb-49502e70ce43","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--930a7be9-762f-5322-9f39-88ae22641ca9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice74s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice74s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--411c6edf-80b0-573d-bfe3-22902f560c92","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--943455a8-29c8-53d4-acb2-279eb91d562d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc5s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc5s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef3607ab-9138-5e8e-b85f-9ccdf36f9690","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--313119c3-8015-55cc-9e8f-4011fdbfc405","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76ed39fb-3e7a-5e13-9fbc-19b3552e0f9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d868985-d832-5730-9e18-25c5f74968c4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62136d17-080a-5f17-88be-c1139a50d5ce","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f6a41b6-81dc-50fe-ac74-d0203b43ee6c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice1s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice1s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--79074b20-2f61-5117-b155-55131ae8fe99","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--822b5ab9-e89e-58d2-a272-b5f72859b3fd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--552c3aff-8cfc-5e75-af5b-bcb2741c2756","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e1f3d60e-2862-5209-b999-2603e28bad08","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice83s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice83s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e3ab8f9-0893-5b38-b01a-10f0259ca34a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a9ed0a6-59ec-5fe5-969c-5fa3d60d10c1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--75b26cf7-f9a0-51a7-9f9a-33edfadac4f4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a665277-7d8f-5c84-abd2-03d892d0dc55","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1533031-f223-522a-ad4b-9e8339abab61","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm40s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm40s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4febd434-034d-56eb-a07d-3a72dd4351da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm40s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm40s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39b8b726-0b5f-5b64-8636-6c1ff3f8b3d4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1dc9eee2-b274-575d-a6f0-6f135a61099d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--676cb504-1373-50d1-adb9-6f794f9c2df4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3375497-3771-5f68-9eee-287f1096939a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ercm-uinvoice25s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ercm-uinvoice25s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00eddc4a-5e17-5d5f-a5ad-b3ca6b6e9c63","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercm-uinvoice75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercm-uinvoice75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aa914ae5-6d09-572b-bba8-9f6f97f1dd36","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercm-uinvoice75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercm-uinvoice75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4a17a89-a7a9-5ffc-be65-80dec8b73c42","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d13af4-3e7c-59bd-a406-f67a1ffce9cc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ercm-uinvoice72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ercm-uinvoice72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c62d5fd-b6a7-52dc-9ece-e033290f5c5d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dae15f60-e014-5191-9392-29b29526fecb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a514247-0a57-550c-99c6-143d4a3cedea","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--302b351f-f06a-5fb3-b360-8cb713afc2a8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48422a00-8ddd-5bc8-a595-10b0f09a1ac2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83db3dfe-4765-53e9-8014-43ffc650ba58","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ntdepchk33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ntdepchk33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d59b431-79cc-5e29-ab3b-264cac790189","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--218ddd62-7bd9-5d5f-b0e6-3b0fd85b6668","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d288942c-2e20-5fd1-a139-3f338fd4ede9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c95a5065-b0b9-5911-bd66-d1b8f9311a48","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a20cca3-e11e-5f14-9451-3dcaa97b86da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nps.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nps.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--56d40863-2d60-55fb-813b-64f611a56fb9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nps.ssltest1.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nps.ssltest1.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--607774cc-4403-5d65-b674-4f5218c2a690","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpaddr70load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpaddr70load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1597ee42-6f02-5d50-bd65-a1ab3f8ce45a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpaddr70load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpaddr70load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6761b366-caa9-54da-a818-498f9c1f359c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b17faca-33ac-5535-92c8-04784255bde7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d50s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d50s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97f19952-bc0c-5210-8772-349ad707ec86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--38c98e9f-6a96-55b6-a643-c5e4b43a4663","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--24e6e687-2cd2-5f8b-9dbf-7e99159bf76b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--47cc526d-47e7-51e6-ab8c-f6b2b2ba08ee","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ndeliver-d23s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ndeliver-d23s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3df8edeb-8720-5fb5-ae0d-ccc29bfe33ce","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ca976e-07a7-5ea0-9a86-1763d0df186b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30a24f1b-5bf8-52fe-a640-a2a0bbaf29ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7ed109e-24ae-5458-996d-9a8fb6da5401","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0caba74-b05d-54d3-9941-cd10cf373989","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9f2d782-3f18-5c81-8897-0fcb275a47bc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eda7e756-6a4f-5992-9289-083167633b1f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nappstatic42svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nappstatic42svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--721f822f-1522-5f77-bc33-216ed4d9f966","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nappstatic42svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nappstatic42svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--268259d4-7fdb-57d7-bddc-4354d3d2a075","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8511ae0e-3b10-57ca-ac56-2a1a7be604a0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d36s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d36s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fface1e2-ef64-522e-9e5a-8391f18cead5","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efbcba1e-9642-5ae0-befe-366c68656fb6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f0b13c6-df90-57f6-af06-50d6aed7f8e7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1cc94d00-ab18-5e7c-b4d5-b294bee25294","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ndeliver-d82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ndeliver-d82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0874dff2-2dee-574b-b43a-1a5709afed8e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34b9d015-bfe5-5b44-a85a-194c2667168a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a30d19ad-16fb-570b-8361-4acda36dec73","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99005c1f-007c-5a24-b75c-80401f309d5c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59bfac5e-8bc5-5336-b18f-daa7fec466eb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--941a6a82-95fb-5a93-ad64-cc950692c3f6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d28s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d28s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb3b9c8e-fbcb-5ea3-ba47-9d7278843450","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0456c90e-44ff-5fff-a54a-bb0463e6880a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d4s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d4s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0605cc8b-cb73-5b7f-b6cb-cc686a3e0cde","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59579804-7a4b-544b-9024-8f4762ba2efa","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d8s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d8s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb3a6766-5eba-5a19-823c-f5dd5ff30746","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50723e8d-0a16-5a73-8d94-7a114aa541f3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d31s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d31s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54d82cc4-7554-5c32-9d23-17a70474c628","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-41v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-41v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce68bddb-84ff-5dba-b0ee-108ef42b07da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-41v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-41v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5da77b6-6e5c-5172-a3ae-91b03312546b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf3718b6-cf83-5a6e-9903-f8f399bef7c9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9550a40c-6f20-5506-b574-cd86696bfd8b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf42s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf42s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c8e3afa-635e-5700-8f53-54b43302535b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf42s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf42s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5278466a-8e69-54c9-acc8-780389c29596","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nmethodsrc13v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmethodsrc13v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--244b599e-18ca-5405-86af-7481d4a514b8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nmethodsrc13v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmethodsrc13v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b11d01d8-6864-5771-960c-ae14e0f08198","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cd5c13f-615d-58f0-a1e1-d2563557b377","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19e5248a-443d-526b-a5dd-701384bfe168","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--863fe6b7-4d0b-5407-8544-315f91381cd1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6deb3db5-6ba5-54a8-ab52-3f1ec8cbb41a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf12s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf12s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dfc280ab-67c8-5e53-a172-7819a17e97b1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf12s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf12s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5dcb17b-fc01-5d9e-9cc7-eca0317cb846","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b464450c-9e21-5e06-9e0e-f6ae0c5b82ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b326d24-e24a-5c41-9c11-6d59c17f8f2a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"uofficialerc26v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uofficialerc26v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36c2f80d-53d0-5ddc-aa2f-b640d39beac4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://uofficialerc26v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uofficialerc26v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e98f870-474b-538c-816d-a7767c4b33f8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2abf4a6-6954-5576-9321-7c5ed5b6c880","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d35s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d35s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3e0fae1-ee39-54ca-80bf-1c0720eeb2d6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25ed1167-d442-5aa5-9b55-0fa58779a2c3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76f15e4a-c6b6-52a5-8816-3d5c232355a4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c20ca816-900f-57bc-ab4b-7db012627008","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc85s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc85s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d389afd3-355b-53fa-9251-5170b9cfb247","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e94e96c9-cfcd-5069-ab45-12118e2032f1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ad53562-f593-55b7-aaee-c515f263df80","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--542d87ad-668a-5cfe-97ab-45f9d0f164ad","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ndeliver-d52s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ndeliver-d52s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7881dede-d5b8-58d8-acc7-427eeedbbbfd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9a3f6b23-1040-5fdb-aba0-a8da2b013639","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ndeliver-d94s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndeliver-d94s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e16cd090-b26b-5f73-919c-faafa6717a5f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cc2bb01-ca78-58e4-bc1b-6172040efe00","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--516d4f8a-8e2b-54ab-a00a-966dca73fbac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4885ed9e-080b-56dd-90b6-b80c8b8e0198","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d79s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d79s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ec0f1b3-ea79-55a9-be50-821943880e95","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02fbce79-c168-5767-bb8e-d2d0b63b30ac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc38s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc38s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a205342c-c3a7-5c09-a606-050ac0d20687","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4df623c1-e500-50d9-970b-2c5d2c96a189","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3505cce-6a47-5cd4-a0ba-05d753334105","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nid.ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29563ae7-6bd3-5ec3-80e7-f11ef0a44616","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nid.ndeliver-d73s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.ndeliver-d73s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40bd9ea4-87ae-5e1c-bece-c090944247d7","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-94v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-94v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--983995c9-d0c3-5649-8a1d-3ea986c68ef3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-94v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-94v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--771eaacf-d673-5afb-9ce6-7ef5d46812cb","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f7ed32b-6ea2-573c-a6f9-773594b1cad8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc92s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc92s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4de493-5cc8-540c-9f1d-371d35cff32f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7d01c30e-f279-5342-a45b-b7703c8a2fda","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d69s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d69s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04e302c1-e0a6-588d-bf36-db9ea0534161","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eed5f2f-bb2b-5f80-899b-0255b044b26e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d21s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d21s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--89a5fd1e-22ce-5c12-96a4-95372319f88a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be7ad8ae-1bf6-5b47-87a4-e540f5690acf","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d33s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d33s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65320c96-139f-5a08-927b-3bccdccaf9de","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ndeliver-d40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndeliver-d40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cfc85b2-d239-541c-8546-c0623b8c987f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ndeliver-d40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndeliver-d40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85dccb0b-a85b-5a41-9462-98bfaa2eefcd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--367674eb-9a25-5dcf-917f-100ff68cfae4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc47s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc47s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--133931c2-950c-58e2-a439-c669951fec1a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d36b4e7-2352-575b-ad36-b39d8c302e29","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc57s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc57s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b2ed046-a857-54ab-9681-371af689077f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f37d4ac9-453d-558c-a9ef-3b3ad3093a84","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc56s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc56s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b7b681-377c-5ef2-a9cc-60dbc09ad14c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7eb79e4-5b28-50f1-a1dc-2d604b7fbd8e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--26275801-123a-56c0-adff-4613598d3083","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol2s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol2s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d13db08-bdb1-5369-9a81-05da77c41dac","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol2s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol2s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6b8c47a-ff6a-5007-bfb2-be50f640b598","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c352616a-1963-5710-91fe-848fa9173a3d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc80s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc80s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37f7a867-4737-5ba6-b4c4-8828eefc0c63","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9edaff60-2cbf-5e40-bc00-1b375f7e6f96","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.ntlogodoc88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.ntlogodoc88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af8f2bc5-7f21-5dc8-95dc-98fa874482fe","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cbc149c-a34a-500c-ad02-06d9add09348","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc45s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc45s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8aa38d7f-5f1a-5329-90ca-a9d2391f9a90","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emebaspol40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emebaspol40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--70be92c4-c053-53f4-8ecb-9e0daaa2883c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emebaspol40s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emebaspol40s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e7416ec8-9793-5b64-970e-a3096ba4248b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c18e484d-8fd9-55ea-a452-71a05d6af5af","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77adeeb7-74d8-59b4-b7d9-362b0e8b06c0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"invoice.ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invoice.ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--453fa80b-0303-5ae8-8d20-2e10eb629f6f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://invoice.ntlogodoc82s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invoice.ntlogodoc82s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f9557be-dca5-5af5-86bc-d84f9b46c21d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf3a89bb-d965-5033-9402-1ac4b80e63e9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc32s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc32s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeb61c7e-4d16-551d-8aea-63037ca28f33","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3cea6c1-3ff6-5583-9bf7-01cb3e8f9b9d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7eb796da-4117-5727-a0b0-d5e4095136f4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntlogodoc44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntlogodoc44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5fd29e7-2187-5d78-8029-1134ad003e8d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntlogodoc44s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntlogodoc44s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02abc625-b1a5-5186-8540-a70f14a6be7f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ercorps-37load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ercorps-37load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ea278633-0d96-54c0-a4a4-1508406530d1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ercorps-37load.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ercorps-37load.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5b5898f-01f6-58e0-a3ba-191a14d30966","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"erpolicies-11v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'erpolicies-11v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a6b85b5-f790-51a1-9c81-5c8cea260cc1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://erpolicies-11v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://erpolicies-11v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a1475723-aec8-5e98-bb59-a7cc3f3c0f04","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol10s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol10s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--81eb64b4-b6dc-5999-b7fd-255af4e2656f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol10s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol10s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35199d60-669e-5f73-ac3b-e1d9bebb4934","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-34v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-34v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0d0a8eaa-06b6-5118-8055-35975ad5b584","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-34v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-34v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9030dada-ca28-5d10-860b-9a43358adc4b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf41s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf41s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69175c2d-9205-5995-ace2-1a3f4f18d7a2","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf41s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf41s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a902e223-47cf-5b62-9ec3-00eb88aa27ba","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--25fd61e7-4bf1-5930-8092-70baaef35893","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f4d9c043-a106-5ac1-9e54-9da33febea4f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf23s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf23s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35d15f98-8acc-5a27-800b-873c75ec735b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf23s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf23s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84b1a3b8-fd6d-5112-a32a-0f82813b7c10","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"usr.ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'usr.ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a58aae51-e7d1-50aa-aec2-de827e67fcb6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://usr.ntdepchk51s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://usr.ntdepchk51s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4a8d880-6b0c-5171-89fc-daf1a4dca577","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a02623b-60df-5a8e-8d2c-c24e97d867e6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk72s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk72s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fa77e47-8626-5161-b502-7acd1a09bc50","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--53285c56-c586-5622-861c-43928084ff2a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk10s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk10s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--77edc265-3df3-59b8-910e-9191a32c777d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e071ee6d-4f6b-51b5-8fe2-930d0a4c4a56","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk75s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk75s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83edd6b0-6cbf-577f-a0d2-7ae754c8788b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nappstatic75svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nappstatic75svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0f6a8ea-5292-5b8d-9fef-fc3a4b666c09","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nappstatic75svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nappstatic75svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d3f8e4bc-5eba-52e8-b815-144e21b9bd5b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0bc3a45-ba96-5138-8e09-c5a71692c4d8","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk19s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk19s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f049814-7198-5808-b017-ee76272f86ee","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8607f47-6502-5a79-8d95-bee88101648c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk89s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk89s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--35935b5e-8192-540e-8a03-0e2616f06fc9","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm31s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm31s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c07bcf5d-feff-5f2b-8cfb-cf3cabd93702","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm31s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm31s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a8ccf45-907c-5fd9-91d0-0351a83ebda1","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ab835c-7ee3-5649-80de-0e06c306edde","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk22s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk22s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--85f96af2-a66e-50eb-abe3-35ea9cb8e100","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm37s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm37s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--251a2753-05db-5a6d-b9c9-5de6fef6df36","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm37s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm37s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b47cd3e-01f2-58ea-a430-b8b94b885205","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol2s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol2s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb07a415-6e9f-5fc4-82b3-548ccd427003","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol2s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol2s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f3e4e9d-d752-525b-a668-6b9a34d40739","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol18s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol18s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44577281-2c87-5780-84ec-84091f20340c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol18s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol18s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50af0e5e-d301-5f9a-8a95-94297bcf1d9b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol1s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol1s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd9051e7-0ee3-5053-8c20-66fb1760fd26","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol1s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol1s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52f9a043-5384-5a64-80a9-24868f9d7c53","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c501d705-763e-5295-b4a6-0f96f998ef3a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol6s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol6s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f72f8a8-eb4b-5374-93c0-87d3b072dc84","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol8s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol8s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fe0696cc-e6ff-5b64-98aa-48305a833872","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol8s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol8s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2a4fe61-36dd-5c8a-98c2-043aec3e2208","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol8s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol8s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--968ad67e-63f8-5c3e-abdc-6c9504f52d25","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol8s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol8s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d223854-bcbd-5cff-a657-e240ae6eaa62","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf30s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf30s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00bd9705-20fb-5162-bea5-069439b52d10","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf30s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf30s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e52f20c-b7df-551d-b783-ba25e45e1e16","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol6s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol6s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4afaa1e-9d19-517b-b848-88cced38df50","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol6s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol6s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16b83fe8-3df6-5c6b-8c4c-da0967871e31","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf17s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf17s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3120cd7-e51e-5a84-aec5-8fa7bbf36237","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf17s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf17s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--008cb3d5-6532-5da9-972a-0eae79e48035","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol7s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol7s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6c886ca-42a1-5953-8fe3-f3347ca6fe44","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol7s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol7s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2301f4ff-e088-5516-ac33-48d1c7fa083b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol10s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol10s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a731f50e-53d0-53e7-8d35-58e3cc246504","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol10s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol10s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76e38c1-b4ce-52f5-adc2-5613d77f9f86","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm19s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm19s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4452b2b0-e740-5133-adc7-e2ab7cb5179e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm19s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm19s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d4970bc-0093-5518-81b9-ef1926b4fa14","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm48s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm48s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--30954b3d-7e1d-5c4d-8a85-3777af393fca","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm48s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm48s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4575dc6-527a-5ada-baca-62b3b04993c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol5s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol5s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--980c78f3-5ec3-5a22-abb3-72ecb620127a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol5s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol5s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e11c68a3-e944-5803-b4d9-579af4cf164b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm44s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm44s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2179a860-81f1-5ad9-b7f8-a8c4efbf7c79","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm44s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm44s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e8e3973-cf26-5d10-9e61-d0b4140dda8d","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"uofficialerc29v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uofficialerc29v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e9c04df-75e4-50dc-83a8-fe74d1ab928f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://uofficialerc29v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uofficialerc29v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb177e9f-4708-5f9d-96d9-e1ef4b1a2747","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol13s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol13s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddc6fd02-ae43-5f09-86a6-a8ce485918da","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol13s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol13s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fec3c566-2caf-519c-817b-be397c670ac4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c0be6f4-c048-56ec-80b3-2e33d77c2cae","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b6cf35b-2704-57f9-999c-7b3c5d35740c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bede498d-edc7-5f78-af32-80f98af91b95","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.newaltercm45s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.newaltercm45s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae24d000-a9c2-56c5-8910-1f69154ed830","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newaltercm15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newaltercm15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a5595df-33f6-5b74-95e0-e29f03d9878f","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newaltercm15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newaltercm15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7b8962f-5576-5b62-8b03-bac1cd699eb0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80954f53-c4dc-50b0-a46d-96313a2ab29c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk88s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk88s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65522bb1-ec01-5884-9084-a84ddcdbe636","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8badf51-c5c8-5a2e-9f43-be46aaf2d36a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6d8eadf-43b0-5b71-9838-ef4cc34cde04","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69b269a5-c7f1-54fc-b816-61dc35a51c19","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ntdepchk26s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ntdepchk26s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb7fe33e-fc42-5eeb-8d9d-1c38f035b44a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol16s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol16s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d312e1c-26ad-57c4-955b-5c62717ac0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol16s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol16s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e45e13f9-b428-5ebb-b8cb-49552d917c37","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol20s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol20s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ca7e67f8-9d40-59ff-b4fa-16ad59c731bc","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol20s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol20s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec3812c3-7150-5fbf-b8a4-a9acde873142","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8442f145-e8bf-51ae-b2ea-6cd0ff90c393","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk77s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk77s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14a2f9f7-cc63-514a-90df-b18dd7edde94","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60ee2143-6365-5474-aafa-d51946d34448","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk29s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk29s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daa2b18f-28e4-52e9-85a7-fee88811ca0b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f2fdda97-890f-5e59-9b37-9fa0cbffbd49","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk86s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk86s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054269866534953072"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e3e8e5f-4c4a-5f13-9a3e-254cbcaf550e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"newpolinf9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'newpolinf9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e491c36-f49e-5418-ba08-829dce981e80","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://newpolinf9s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://newpolinf9s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e748aa77-6c7c-5e02-b3e9-a46aea11166e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"emspol4s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'emspol4s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96bff0b-25da-5e7e-8981-222bf354b299","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://emspol4s.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://emspol4s.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efdbaeb1-952c-5428-ab73-0e5f84cbf213","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"docinfo.ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d52e039b-f33e-5a21-a3bd-b887c99e1036","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://docinfo.ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b4bd45f7-bce0-5a78-b87e-18fa6fcff329","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f4a27bf-53d5-57c3-9baa-4d3369f77d33","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk65s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk65s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf926598-5c73-5c0e-95b1-c4b056f3c352","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--83b393fa-755e-51b7-9b4a-efd6abe351b4","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk87s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk87s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b39d9984-f356-5ce0-a90f-485d1bd4a76c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"ntdepchk17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntdepchk17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e5fc240-ff84-540b-8592-6fcab818c248","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://ntdepchk17s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntdepchk17s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--43ba2ca1-a2f7-5752-a746-15025fbf1dd0","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm6v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm6v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20dd6773-49fa-5cb8-910f-dfbf106c5477","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm6v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm6v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5432e9f7-7711-582d-aeaa-ecb557a6fde3","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nmethodsrc15v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nmethodsrc15v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--764c5464-1bd2-585d-85ca-7bcd6a11658a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nmethodsrc15v.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nmethodsrc15v.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdc90adc-22a1-5fff-93af-da9dedfdac35","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol4s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol4s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--381f83dc-da05-541c-bae2-1516c69fcf1c","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol4s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol4s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f740b1a-56b3-52b9-8514-df006847ff42","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nhpolercm98v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nhpolercm98v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--315d8e1c-9698-556a-a389-b8b030c11723","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nhpolercm98v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nhpolercm98v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--914cf54e-d147-5568-b653-2c0a3758e79e","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"nps-authdep69svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nps-authdep69svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d0c293da-9b29-522a-a77a-213b884a7afd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://nps-authdep69svc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nps-authdep69svc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bf504f0-681b-5e52-95c4-8802974ca0c6","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"polercm-85v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'polercm-85v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2ee7dba6-a490-5807-a79b-0b3478c86838","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://polercm-85v.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://polercm-85v.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2556d9b-bcc1-5f5c-8517-9b2abcfd118a","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8cf30ead-b96e-5761-8a07-2a2f5a7824bd","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d56c44e2-9135-5518-99f8-89726ce50305","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"edoc.inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edoc.inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--92517221-a047-5a1a-9abe-49f4b60d1b7b","created":"2026-05-12T18:37:00.000Z","modified":"2026-05-12T18:37:00.000Z","valid_from":"2026-05-12T18:37:00.000Z","name":"http://edoc.inlinepol15s.roxa.org","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edoc.inlinepol15s.roxa.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2049924547810299999"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c7607356-4c49-53b5-aa77-a77e25edb74d","created":"2026-05-12T20:00:00.000Z","modified":"2026-05-12T20:00:00.000Z","valid_from":"2026-05-12T20:00:00.000Z","name":"finalaccountwarningteam.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'finalaccountwarningteam.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054290551369781289"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ba951a8-78c5-5114-bf57-95673264188f","created":"2026-05-12T20:00:00.000Z","modified":"2026-05-12T20:00:00.000Z","valid_from":"2026-05-12T20:00:00.000Z","name":"https://finalaccountwarningteam.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://finalaccountwarningteam.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054290551369781289"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97d3052e-475d-5602-9f7f-06283de5aa33","created":"2026-05-12T22:00:00.000Z","modified":"2026-05-12T22:00:00.000Z","valid_from":"2026-05-12T22:00:00.000Z","name":"xploreonlineserver.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xploreonlineserver.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054320750966792413"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd02bfc8-bcae-5d90-b24b-6f0c515768e4","created":"2026-05-12T22:00:00.000Z","modified":"2026-05-12T22:00:00.000Z","valid_from":"2026-05-12T22:00:00.000Z","name":"https://xploreonlineserver.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xploreonlineserver.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054320750966792413"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5532f769-d90b-5a40-b84f-37200d91f0ee","created":"2026-05-13T00:00:00.000Z","modified":"2026-05-13T00:00:00.000Z","valid_from":"2026-05-13T00:00:00.000Z","name":"netflix-clone-6.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'netflix-clone-6.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054350942758178970"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eeea70e7-12cc-53e7-a1aa-4a9045e651eb","created":"2026-05-13T00:00:00.000Z","modified":"2026-05-13T00:00:00.000Z","valid_from":"2026-05-13T00:00:00.000Z","name":"https://netflix-clone-6.vercel.app","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://netflix-clone-6.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054350942758178970"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f762b2c-847a-5132-b2be-abc0d7347052","created":"2026-05-13T00:22:00.000Z","modified":"2026-05-13T00:22:00.000Z","valid_from":"2026-05-13T00:22:00.000Z","name":"b10a.mobi","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'b10a.mobi']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054356678276264197"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--daf90ef3-ed61-55f2-9fd7-94aa413f960e","created":"2026-05-13T00:22:00.000Z","modified":"2026-05-13T00:22:00.000Z","valid_from":"2026-05-13T00:22:00.000Z","name":"https://b10a.mobi/BANTEND","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://b10a.mobi/BANTEND']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054356678276264197"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7328cd5-0842-5aa1-befb-bd14a0ad9b2e","created":"2026-05-13T02:00:00.000Z","modified":"2026-05-13T02:00:00.000Z","valid_from":"2026-05-13T02:00:00.000Z","name":"roblox.gf","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'roblox.gf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054381165683913185"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5309cd3b-98eb-5be5-974f-48f05124ba04","created":"2026-05-13T02:00:00.000Z","modified":"2026-05-13T02:00:00.000Z","valid_from":"2026-05-13T02:00:00.000Z","name":"https://roblox.gf/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=51941004943843141444838697520702","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://roblox.gf/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=51941004943843141444838697520702']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054381165683913185"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9c9e70e8-2787-5c86-9bfe-870b1dc8fc02","created":"2026-05-13T02:46:00.000Z","modified":"2026-05-13T02:46:00.000Z","valid_from":"2026-05-13T02:46:00.000Z","name":"leyalobis.z33.web.core.windows.net","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'leyalobis.z33.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054392935853306303"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bf26007-7afe-571a-a2b9-ebdbbef855b6","created":"2026-05-13T02:46:00.000Z","modified":"2026-05-13T02:46:00.000Z","valid_from":"2026-05-13T02:46:00.000Z","name":"https://leyalobis.z33.web.core.windows.net/zucs06iym6hj.html#XwlyjVk2plhmle31","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://leyalobis.z33.web.core.windows.net/zucs06iym6hj.html#XwlyjVk2plhmle31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054392935853306303"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6d32f89-eb71-5d0a-bc44-4b438c66c7c1","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"qr.paypay.ne.jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qr.paypay.ne.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b25461-10e6-5c3b-912d-a0c6dca6ff85","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_5xY8eHfpfy5DM8nN","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_5xY8eHfpfy5DM8nN']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--db3d18ad-d8ed-58a6-9b16-de5e219c2d32","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"45.91.227.43","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '45.91.227.43']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c88a2879-e7ad-522d-b4c3-4f33eef26ea7","created":"2026-05-13T03:01:00.000Z","modified":"2026-05-13T03:01:00.000Z","valid_from":"2026-05-13T03:01:00.000Z","name":"3.164.143.89","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.164.143.89']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054396644297515461"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72b64ca2-3bbf-5c06-9944-5c5a1079c798","created":"2026-05-13T03:32:00.000Z","modified":"2026-05-13T03:32:00.000Z","valid_from":"2026-05-13T03:32:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_FuYCLAoaAmaqk9n9","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_FuYCLAoaAmaqk9n9']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404330250473931"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c7e1948-401b-5cf3-b470-3205e68d8cf4","created":"2026-05-13T03:32:00.000Z","modified":"2026-05-13T03:32:00.000Z","valid_from":"2026-05-13T03:32:00.000Z","name":"123.180.19.119","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '123.180.19.119']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404330250473931"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a611e54a-2768-5149-8345-af24ce72f587","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"noblemist.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'noblemist.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404688779640949"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a0747771-3668-5a0b-9aa0-b2684651a85e","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"https://noblemist.com/notice/information","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://noblemist.com/notice/information']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054404688779640949"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ed3b386d-d2db-5e82-99ad-f24ddc5d083d","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"e-stat.url-btiyu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.url-btiyu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054404649340506433"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc38a870-5201-5114-8f16-9ae3e8ccb7b8","created":"2026-05-13T03:33:00.000Z","modified":"2026-05-13T03:33:00.000Z","valid_from":"2026-05-13T03:33:00.000Z","name":"https://e-stat.url-btiyu.com/home","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.url-btiyu.com/home']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054404649340506433"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ae5e630-267f-5bc2-9dd8-2d67c83c7f8d","created":"2026-05-13T03:49:00.000Z","modified":"2026-05-13T03:49:00.000Z","valid_from":"2026-05-13T03:49:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_mP0rCB0KG2fij2Zn","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_mP0rCB0KG2fij2Zn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408782344798435"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10b78e32-9fce-5464-85f1-7ae310f94354","created":"2026-05-13T03:49:00.000Z","modified":"2026-05-13T03:49:00.000Z","valid_from":"2026-05-13T03:49:00.000Z","name":"2.59.152.85","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '2.59.152.85']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408782344798435"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--16f549fa-f527-5e63-a4fa-42fa589b63fd","created":"2026-05-13T03:50:00.000Z","modified":"2026-05-13T03:50:00.000Z","valid_from":"2026-05-13T03:50:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_vi5lr3RFpYtB9JCq","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_vi5lr3RFpYtB9JCq']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408970035737025"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7203464b-723b-5a51-9fdb-ae72cb982cb8","created":"2026-05-13T03:50:00.000Z","modified":"2026-05-13T03:50:00.000Z","valid_from":"2026-05-13T03:50:00.000Z","name":"113.236.106.100","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '113.236.106.100']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054408970035737025"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b3e38f2-9bbd-56b1-a925-8d61c3323c80","created":"2026-05-13T03:59:00.000Z","modified":"2026-05-13T03:59:00.000Z","valid_from":"2026-05-13T03:59:00.000Z","name":"49.87.27.41","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '49.87.27.41']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054411058723569806"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7887d2d-f9ff-552a-8cf7-0d38cbf9c7c1","created":"2026-05-13T04:00:00.000Z","modified":"2026-05-13T04:00:00.000Z","valid_from":"2026-05-13T04:00:00.000Z","name":"pub-3201b0059e074b9486139d100a5af429.r2.dev","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pub-3201b0059e074b9486139d100a5af429.r2.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054411363666059286"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--938c7c0c-faa7-553d-bdc3-1ccdea770462","created":"2026-05-13T04:00:00.000Z","modified":"2026-05-13T04:00:00.000Z","valid_from":"2026-05-13T04:00:00.000Z","name":"http://pub-3201b0059e074b9486139d100a5af429.r2.dev/bv.html","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pub-3201b0059e074b9486139d100a5af429.r2.dev/bv.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054411363666059286"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0025b4f-dbd7-587a-ad09-dd0f26fb2d1c","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"nybjhw.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nybjhw.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6bf0453-d4c6-5e24-8053-2fce7ecc589b","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"https://nybjhw.com/?type=verify&key=gzpbbcpsqq","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://nybjhw.com/?type=verify&key=gzpbbcpsqq']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72dfda7b-78d5-5173-9920-4c2268a6f67e","created":"2026-05-13T04:11:00.000Z","modified":"2026-05-13T04:11:00.000Z","valid_from":"2026-05-13T04:11:00.000Z","name":"34.146.118.97","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.146.118.97']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414268133786028"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fc5873d-7efc-56b9-b095-f7a02b1fc206","created":"2026-05-13T04:12:00.000Z","modified":"2026-05-13T04:12:00.000Z","valid_from":"2026-05-13T04:12:00.000Z","name":"zfhcbj.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'zfhcbj.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414428788170809"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71c400fb-6b42-55f7-9434-def9528d3b37","created":"2026-05-13T04:12:00.000Z","modified":"2026-05-13T04:12:00.000Z","valid_from":"2026-05-13T04:12:00.000Z","name":"https://zfhcbj.com/?type=verify&key=olamzfolnj","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://zfhcbj.com/?type=verify&key=olamzfolnj']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054414428788170809"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f8d475c-d07c-51d7-a33c-d4be6787a369","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"209.87.149.168","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '209.87.149.168']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419826173751790"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad40e881-d7f0-54d3-97ad-1d61e86c2eb7","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"startcompliance.click","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'startcompliance.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419841122279859"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6adfab4-1278-5eb1-8297-54f333ed9454","created":"2026-05-13T04:33:00.000Z","modified":"2026-05-13T04:33:00.000Z","valid_from":"2026-05-13T04:33:00.000Z","name":"https://www.startcompliance.click/kFNQHbvZ8-F1mOj4BOJX-mUNSJP6u-wApaUVu/index.html","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://www.startcompliance.click/kFNQHbvZ8-F1mOj4BOJX-mUNSJP6u-wApaUVu/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054419841122279859"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c396cf03-ccbd-58fe-89f4-1d08fe260c56","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"anxingcharge.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'anxingcharge.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bb6c49b-6083-5d6e-abb4-d564c2d6e783","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"https://anxingcharge.com/7HRL93uV34.social","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://anxingcharge.com/7HRL93uV34.social']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--80d187ea-4b27-592a-86b1-d12b7fec4732","created":"2026-05-13T04:45:00.000Z","modified":"2026-05-13T04:45:00.000Z","valid_from":"2026-05-13T04:45:00.000Z","name":"150.136.228.252","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.228.252']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422831187014122"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--357bd60b-7fb3-5e9e-87e7-df1cd66e6024","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"apexkongbai.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'apexkongbai.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6dab82ba-2d36-5051-9b63-ef7d6ddc1eef","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"https://apexkongbai.com/NyLTmazo5C.axd","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://apexkongbai.com/NyLTmazo5C.axd']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc8b2508-96cc-5d1a-80ea-5b29f575659a","created":"2026-05-13T04:46:00.000Z","modified":"2026-05-13T04:46:00.000Z","valid_from":"2026-05-13T04:46:00.000Z","name":"150.136.126.82","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '150.136.126.82']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054422987999494184"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50e02826-4805-56bf-8f61-2e48a4f05c4c","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"annovireverberipump.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'annovireverberipump.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--948dde97-2b11-59dc-9696-7687f3617572","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"https://annovireverberipump.com/sEv8lV0zeT.niigata-city.jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://annovireverberipump.com/sEv8lV0zeT.niigata-city.jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df62cf30-d095-52fb-86d9-b7817e7be7da","created":"2026-05-13T04:47:00.000Z","modified":"2026-05-13T04:47:00.000Z","valid_from":"2026-05-13T04:47:00.000Z","name":"192.9.155.132","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '192.9.155.132']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054423168975311327"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d3a55ed-0c3c-52f5-aa18-34153535723e","created":"2026-05-13T04:54:00.000Z","modified":"2026-05-13T04:54:00.000Z","valid_from":"2026-05-13T04:54:00.000Z","name":"jp.5-13paypayz.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jp.5-13paypayz.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054425017224704246"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e54e4a11-7069-5510-8982-e60c818ad2d8","created":"2026-05-13T04:54:00.000Z","modified":"2026-05-13T04:54:00.000Z","valid_from":"2026-05-13T04:54:00.000Z","name":"https://jp.5-13paypayz.com/jp","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jp.5-13paypayz.com/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054425017224704246"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d99825-c0d9-5eac-95a6-6cd5fa27d04a","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"miont.hair","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'miont.hair']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a49d53bd-d11e-5f3d-ba40-65bcdd315a0e","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"https://miont.hair/?email=vwiyf","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://miont.hair/?email=vwiyf']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--223ced62-a78f-5aa0-8d15-c88ad5d0fcf4","created":"2026-05-13T05:01:00.000Z","modified":"2026-05-13T05:01:00.000Z","valid_from":"2026-05-13T05:01:00.000Z","name":"52.103.20.94","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '52.103.20.94']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054426734158852466"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--739b4e5d-d209-5089-a866-30a4ec56abba","created":"2026-05-13T05:33:00.000Z","modified":"2026-05-13T05:33:00.000Z","valid_from":"2026-05-13T05:33:00.000Z","name":"annakovaleva.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'annakovaleva.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054434942910931179"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--861f4a7c-1522-544b-a954-ce6a5427889d","created":"2026-05-13T05:33:00.000Z","modified":"2026-05-13T05:33:00.000Z","valid_from":"2026-05-13T05:33:00.000Z","name":"https://annakovaleva.com/?type=verify&key=pfvbhfjzjx","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://annakovaleva.com/?type=verify&key=pfvbhfjzjx']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054434942910931179"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48f037ae-18b9-59a9-a250-db03b478aff5","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"mbapped.com","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mbapped.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58772937-7d99-5281-8104-ee02e70c0bed","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://mbapped.com/?type=verify&key=rsgttabfsb","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mbapped.com/?type=verify&key=rsgttabfsb']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb1cfc4e-941a-5d0f-9eb1-956e1314a300","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"34.146.134.26","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.146.134.26']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7415361b-f45d-51f0-bbbc-8c8adc048ebd","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"101.32.97.203","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '101.32.97.203']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435265381601389"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--48ac6c13-3a9f-5af2-8abc-20e806074c16","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://mbapped.com/captcha/go/44e6a0422861f04489a0488ad82c4771","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mbapped.com/captcha/go/44e6a0422861f04489a0488ad82c4771']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f7a2e88-01e9-58a2-98a8-9ff8d865ef28","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"cvuhvbkeoqdu.top","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cvuhvbkeoqdu.top']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c972f95-1d7c-5baf-af25-86e8bf02acfe","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"https://cvuhvbkeoqdu.top/jp","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cvuhvbkeoqdu.top/jp']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--131efb0b-f1c6-52ef-825a-353eaef38a31","created":"2026-05-13T05:35:00.000Z","modified":"2026-05-13T05:35:00.000Z","valid_from":"2026-05-13T05:35:00.000Z","name":"43.167.190.152","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '43.167.190.152']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054435267168370743"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f5ee7bd-73f7-5912-b2cd-8cbeb415f9c1","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"ccssnk.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ccssnk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64e2aef9-22ee-511e-ac3e-e0e5baa45a9c","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"https://ccssnk.com","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ccssnk.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1c2f3c1-ff30-5a4b-bd3b-535c1e4ae2e1","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"http://8.209.198.204","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8.209.198.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--62cf8673-1bc0-539f-810e-c31a03d98d36","created":"2026-05-13T05:40:00.000Z","modified":"2026-05-13T05:40:00.000Z","valid_from":"2026-05-13T05:40:00.000Z","name":"8.209.198.204","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.209.198.204']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054436697312833572"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8afe383c-8aed-58df-a191-fc64347b4a49","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"dsoqqcfd.vjxjrfyu.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsoqqcfd.vjxjrfyu.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f611528b-0dd2-59fb-8354-fc7b944de9c9","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"https://dsoqqcfd.vjxjrfyu.cn/optmer-prefere_html/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsoqqcfd.vjxjrfyu.cn/optmer-prefere_html/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b5e91e1-b504-59fc-9a8d-41f21c788a10","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"http://165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-13T05:52:00.000Z","modified":"2026-05-13T05:52:00.000Z","valid_from":"2026-05-13T05:52:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054439630809030771"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f1fa25f9-8343-5b9e-90ed-c668731f851f","created":"2026-05-13T06:07:00.000Z","modified":"2026-05-13T06:07:00.000Z","valid_from":"2026-05-13T06:07:00.000Z","name":"cqizvybx.bhmsbp.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cqizvybx.bhmsbp.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054443329186828792"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cfc6e74f-2b2e-52f0-881f-b1768e3cb28e","created":"2026-05-13T06:07:00.000Z","modified":"2026-05-13T06:07:00.000Z","valid_from":"2026-05-13T06:07:00.000Z","name":"https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://cqizvybx.bhmsbp.cn/iiufhys/eorio/loging/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054443329186828792"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c01cddb2-e631-51f6-ac8f-58670359a330","created":"2026-05-13T06:15:00.000Z","modified":"2026-05-13T06:15:00.000Z","valid_from":"2026-05-13T06:15:00.000Z","name":"4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '4453b9e985f452365995c399f5292c92764570f03e6a066d7845320dd4ad09a1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054445326355124566"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--499e1686-82f7-5dd3-96fa-344c1a5d969c","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"https://qr.paypay.ne.jp/p2p01_uzRRJAYVKj3BlCER","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://qr.paypay.ne.jp/p2p01_uzRRJAYVKj3BlCER']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f51c768e-72c8-5c3e-b54c-6752337c016c","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"60.21.12.25","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '60.21.12.25']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--637914f5-7718-5d6c-a770-a8b51e861a65","created":"2026-05-13T06:27:00.000Z","modified":"2026-05-13T06:27:00.000Z","valid_from":"2026-05-13T06:27:00.000Z","name":"3.164.143.129","description":"IOC reported by @romonlyht on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '3.164.143.129']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/romonlyht/status/2054448490722549945"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--297d0bb2-dd5b-53ef-8172-3a7e5b16ee3a","created":"2026-05-13T06:39:00.000Z","modified":"2026-05-13T06:39:00.000Z","valid_from":"2026-05-13T06:39:00.000Z","name":"867514.app","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = '867514.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054451554615275819"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ed671c5-d8b1-5272-b034-3fc91e4d05ac","created":"2026-05-13T06:39:00.000Z","modified":"2026-05-13T06:39:00.000Z","valid_from":"2026-05-13T06:39:00.000Z","name":"http://867514.app","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://867514.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054451554615275819"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9692a4cd-bcd4-5797-9d7e-9b2b71b60559","created":"2026-05-13T06:44:00.000Z","modified":"2026-05-13T06:44:00.000Z","valid_from":"2026-05-13T06:44:00.000Z","name":"77.91.97.125","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '77.91.97.125']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054452806208106938"}],"labels":["NetSupport","RAT","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4a41874-022d-5081-a3a8-ab08c586eda6","created":"2026-05-13T06:44:00.000Z","modified":"2026-05-13T06:44:00.000Z","valid_from":"2026-05-13T06:44:00.000Z","name":"91.92.34.113","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '91.92.34.113']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054452806208106938"}],"labels":["NetSupport","RAT","booking"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e9d28e1-fd39-5405-8d92-835b60409858","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"e-stat.online-6t.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-6t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08c93c45-7232-520c-862d-2c5a2260ce29","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"https://e-stat.online-6t.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-6t.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--10757f5f-bada-5abe-be20-889421188603","created":"2026-05-13T06:52:00.000Z","modified":"2026-05-13T06:52:00.000Z","valid_from":"2026-05-13T06:52:00.000Z","name":"https://e-stat.url-btiyu.com/ktwpraic","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.url-btiyu.com/ktwpraic']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054454692173033646"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ee083bb-b273-514e-bcf9-8f0d3cf916aa","created":"2026-05-13T07:20:00.000Z","modified":"2026-05-13T07:20:00.000Z","valid_from":"2026-05-13T07:20:00.000Z","name":"kifofjfjeio488dzedeuihui48.cfolks.pl","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kifofjfjeio488dzedeuihui48.cfolks.pl']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054461663802183992"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e05de5be-1817-5f5c-b320-3481e63ab1fa","created":"2026-05-13T07:20:00.000Z","modified":"2026-05-13T07:20:00.000Z","valid_from":"2026-05-13T07:20:00.000Z","name":"https://kifofjfjeio488dzedeuihui48.cfolks.pl/at/vx/auth/log","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kifofjfjeio488dzedeuihui48.cfolks.pl/at/vx/auth/log']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054461663802183992"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5ab291bf-d8d2-5749-a474-5889e95e2aaf","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"e-stat.cn-web-tg.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.cn-web-tg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--626226e6-50a7-5cc4-9c82-90763455d7c0","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"https://e-stat.cn-web-tg.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.cn-web-tg.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6fee105-b3d9-5d2a-9934-869c1d1ea67c","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"e-stat.online-k1.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.online-k1.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d266919a-9259-53ef-9e3d-29f667c7be7d","created":"2026-05-13T07:21:00.000Z","modified":"2026-05-13T07:21:00.000Z","valid_from":"2026-05-13T07:21:00.000Z","name":"https://e-stat.online-k1.com/oo6z309q","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.online-k1.com/oo6z309q']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054462055852466267"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c748a5d-7c6a-5516-8243-9de1ba6d42fd","created":"2026-05-13T07:27:00.000Z","modified":"2026-05-13T07:27:00.000Z","valid_from":"2026-05-13T07:27:00.000Z","name":"e-stat.zp12362.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'e-stat.zp12362.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054463514417451467"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8eeedde-4e1b-55ac-a133-2f849c68146e","created":"2026-05-13T07:27:00.000Z","modified":"2026-05-13T07:27:00.000Z","valid_from":"2026-05-13T07:27:00.000Z","name":"https://e-stat.zp12362.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://e-stat.zp12362.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054463514417451467"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f4e30cc-809e-54b8-ac4c-6a29653156c0","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"http://github.com/ud-7-te","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/ud-7-te']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--045911c9-d7bf-5852-942a-f5a90d093a27","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"http://github.com/d7-te","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/d7-te']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6da7ae95-e59e-553e-b265-6b7a9429987f","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"710cf679e48afe00493042c16a74b482","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '710cf679e48afe00493042c16a74b482']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054465875894472721"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--697c2102-6551-5c91-9dd3-459f4613420a","created":"2026-05-13T07:36:00.000Z","modified":"2026-05-13T07:36:00.000Z","valid_from":"2026-05-13T07:36:00.000Z","name":"8eeadec70143f1f24635c690e7809285","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '8eeadec70143f1f24635c690e7809285']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2047656208115658987"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd11c81e-9804-5b24-8f92-3745fb0b4b6e","created":"2026-05-13T07:46:00.000Z","modified":"2026-05-13T07:46:00.000Z","valid_from":"2026-05-13T07:46:00.000Z","name":"34.142.2.43","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '34.142.2.43']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054468394850906419"}],"labels":["C2","RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad7d4e38-8106-5c84-8154-54cea7642112","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"app-1776040489-oweyma.api-539826ff.workers.dev","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'app-1776040489-oweyma.api-539826ff.workers.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--958b0d43-5ccb-5bb2-b15b-8d1f7d518cf3","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"http://app-1776040489-oweyma.api-539826ff.workers.dev","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://app-1776040489-oweyma.api-539826ff.workers.dev']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0499ca76-dde5-57db-91bf-8e8991dd401a","created":"2026-05-13T07:49:00.000Z","modified":"2026-05-13T07:49:00.000Z","valid_from":"2026-05-13T07:49:00.000Z","name":"8aadebc4fb43fb6cf3d81d5aa35eb479b9f38087d7f5fcd8f5767535dc548859","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8aadebc4fb43fb6cf3d81d5aa35eb479b9f38087d7f5fcd8f5767535dc548859']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054469006459879433"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6baffbac-7606-527f-95b8-a9a44012ca84","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"paypal-signin.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'paypal-signin.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054471755540890014"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cec6faca-9537-53e4-b688-a694213449a3","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"http://www.paypal-signin.blogspot.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www.paypal-signin.blogspot.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054471755540890014"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb23a78f-21f0-5f04-9679-0fcb2a1af631","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"lanotive.z16.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'lanotive.z16.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054471944079339856"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6d3bb538-d099-5b12-90b0-afe7033ba2b6","created":"2026-05-13T08:00:00.000Z","modified":"2026-05-13T08:00:00.000Z","valid_from":"2026-05-13T08:00:00.000Z","name":"https://lanotive.z16.web.core.windows.net","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://lanotive.z16.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054471944079339856"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--702ddb4f-04fb-5f54-9c40-2707cb3841df","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"sixtysixrealestate.com","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sixtysixrealestate.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6ff5ac5-593f-57d1-8bb3-0d6a2d3fef4d","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"https://sixtysixrealestate.com/wp-admin/maint/sophomore/?bfx=AkLwe12026-05-13","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sixtysixrealestate.com/wp-admin/maint/sophomore/?bfx=AkLwe12026-05-13']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a70fb165-e254-5e33-8104-741b8594ff3e","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"https://sixtysixrealestate.com/wp-admin/maint/sophomore/?Eey=cWJvT02026-05-07","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sixtysixrealestate.com/wp-admin/maint/sophomore/?Eey=cWJvT02026-05-07']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d650c19-9349-580d-aa8e-872346fc0e2c","created":"2026-05-13T08:05:00.000Z","modified":"2026-05-13T08:05:00.000Z","valid_from":"2026-05-13T08:05:00.000Z","name":"a609fb6d4924595384e1459bd5935d295c7e559282d3d9ec31baf9bd59e39525","description":"IOC reported by @byrne_emmy12099 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'a609fb6d4924595384e1459bd5935d295c7e559282d3d9ec31baf9bd59e39525']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/byrne_emmy12099/status/2054472984606486958"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d54e9a2-624b-5bb8-9b3f-c66ffd6d1c25","created":"2026-05-13T08:30:00.000Z","modified":"2026-05-13T08:30:00.000Z","valid_from":"2026-05-13T08:30:00.000Z","name":"78.17.41.10","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '78.17.41.10']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054479449056596078"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--34223158-d317-5d2c-9952-d59dd203cb60","created":"2026-05-13T08:53:00.000Z","modified":"2026-05-13T08:53:00.000Z","valid_from":"2026-05-13T08:53:00.000Z","name":"e6c60ca4f996b209bbaf7429182d7ed76acf761bb9c1de63486fcb76635fa58c","description":"IOC reported by @GGtld on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e6c60ca4f996b209bbaf7429182d7ed76acf761bb9c1de63486fcb76635fa58c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GGtld/status/2054485228077355101"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a3ddf02f-e9a6-5cd6-8e66-d88d40dcd97a","created":"2026-05-13T08:53:00.000Z","modified":"2026-05-13T08:53:00.000Z","valid_from":"2026-05-13T08:53:00.000Z","name":"80.97.160.51","description":"IOC reported by @GGtld on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '80.97.160.51']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/GGtld/status/2054485214399754371"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c66da211-6d51-5193-980e-f8f9a3230506","created":"2026-05-13T09:18:00.000Z","modified":"2026-05-13T09:18:00.000Z","valid_from":"2026-05-13T09:18:00.000Z","name":"0e78b6737119a3141e466464ee2748eb84a61750958d0cb5824febbdadd875be","description":"IOC reported by @v12sec on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0e78b6737119a3141e466464ee2748eb84a61750958d0cb5824febbdadd875be']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/v12sec/status/2053221862608445645"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c5274f6-a41c-5ad8-8633-a728c257b75b","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"http://103.187.4.61","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://103.187.4.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--aacd632c-b06c-5cb4-833f-fa0589203901","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"103.187.4.61","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '103.187.4.61']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8120dd55-13bc-59a1-81cc-28e96dce1801","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"0e57107c60632e756ab1684777842170","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '0e57107c60632e756ab1684777842170']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0593a08-4c05-5a05-9b10-44584c27b7a3","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"f4b35de8b2442f2f20bcaa6250e8aae3","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = 'f4b35de8b2442f2f20bcaa6250e8aae3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d08faf9-7659-5e8c-92f1-fdb1181a7d5d","created":"2026-05-13T09:24:00.000Z","modified":"2026-05-13T09:24:00.000Z","valid_from":"2026-05-13T09:24:00.000Z","name":"97e5b28bd19ff01aaa24cb7b1bae135c","description":"IOC reported by @suyog41 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '97e5b28bd19ff01aaa24cb7b1bae135c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/suyog41/status/2054492929163657234"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb25473e-fe0f-581a-9c7f-cf97790e1b9f","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"xwjyzxf-jp77.icu","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0fd7b21-6fb9-5799-9460-9393e984554e","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"http://xwjyzxf-jp77.icu","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a8c4220-37d8-5fe2-861f-fad340ef010f","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"4926590d8ced37f434d47d4a27ad1444","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '4926590d8ced37f434d47d4a27ad1444']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f60ebad-45f1-5cd4-82db-064b582be537","created":"2026-05-13T09:35:00.000Z","modified":"2026-05-13T09:35:00.000Z","valid_from":"2026-05-13T09:35:00.000Z","name":"0a1fd68a1fbab226ed926977f89df6621713aac36da7ee076a30db99d8be4c5c","description":"IOC reported by @_tdatwja on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '0a1fd68a1fbab226ed926977f89df6621713aac36da7ee076a30db99d8be4c5c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/_tdatwja/status/2054495725900480924"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a7bd414-1b3a-5ad6-b367-2f1b7785bf46","created":"2026-05-13T09:56:00.000Z","modified":"2026-05-13T09:56:00.000Z","valid_from":"2026-05-13T09:56:00.000Z","name":"pexaro.vu","description":"IOC reported by @Priv8Shops on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pexaro.vu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Priv8Shops/status/2054500930129907753"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af2bb779-aa2b-57e6-9f5e-110d2e06724f","created":"2026-05-13T09:56:00.000Z","modified":"2026-05-13T09:56:00.000Z","valid_from":"2026-05-13T09:56:00.000Z","name":"https://pexaro.vu/nja/index.html","description":"IOC reported by @Priv8Shops on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://pexaro.vu/nja/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Priv8Shops/status/2054500930129907753"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--655f0ada-0a2e-5a6b-bac3-4fea38241330","created":"2026-05-13T10:00:00.000Z","modified":"2026-05-13T10:00:00.000Z","valid_from":"2026-05-13T10:00:00.000Z","name":"upohold-logiinus.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'upohold-logiinus.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054501957050491130"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49e2daa3-2475-58b9-810a-050ecbb896fe","created":"2026-05-13T10:00:00.000Z","modified":"2026-05-13T10:00:00.000Z","valid_from":"2026-05-13T10:00:00.000Z","name":"https://upohold-logiinus.godaddysites.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://upohold-logiinus.godaddysites.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054501957050491130"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef3425ed-e8d5-59db-9f37-36cce4da0ddd","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"http://151.80.169.178","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://151.80.169.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cb50a4ff-0d71-584f-9042-97605a4a002f","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"151.80.169.178","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '151.80.169.178']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--82ce4f6d-5239-5ba2-ba78-93f364634aa5","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"e2d282627a232e4f6231c8ff0108a08b4e40c14104199d78a9e7e08ff377f248","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'e2d282627a232e4f6231c8ff0108a08b4e40c14104199d78a9e7e08ff377f248']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0471370e-5ec9-5544-8b80-b8e41107dabd","created":"2026-05-13T10:40:00.000Z","modified":"2026-05-13T10:40:00.000Z","valid_from":"2026-05-13T10:40:00.000Z","name":"098be7f80aa90d2fcdd2996d8d4126f7a7fb759d429cc9f6327c9bdd48afc1b8","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '098be7f80aa90d2fcdd2996d8d4126f7a7fb759d429cc9f6327c9bdd48afc1b8']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054512062781378663"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9fcad5ab-b2f4-5dea-a7e9-5306722d15a4","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e0a691bb-92a8-5194-8a2c-8243f386b230","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"http://www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://www11811wwqdqq-1387243555.cos.ap-hongkong.myqcloud.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a99a7089-ef2d-5de2-b778-9f42bc849d9d","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"http://8.218.252.45","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://8.218.252.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--54d84a8a-b2b5-5812-ab76-badef0695c5a","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"8.218.252.45","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '8.218.252.45']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--32effdbf-c1dc-5c4e-aeca-2e1ae9b42c00","created":"2026-05-13T10:44:00.000Z","modified":"2026-05-13T10:44:00.000Z","valid_from":"2026-05-13T10:44:00.000Z","name":"d5b10a827a2811d516cf6e0d601eb9d7354d37b7d7e5791aceb0227482f3227a","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd5b10a827a2811d516cf6e0d601eb9d7354d37b7d7e5791aceb0227482f3227a']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054513108031316006"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6cf55e3-4ebc-53f5-8fb3-ae1e361491f3","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"velmorixan67.org","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'velmorixan67.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fc0912f-601b-5bf1-87d7-44c0d085d1f0","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"http://velmorixan67.org","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://velmorixan67.org']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--bc26d257-abd3-557d-a548-58b4ade08327","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"expressupdatedata.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'expressupdatedata.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0ff28b6d-c56f-579f-9f04-f4fb9ada35f1","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"http://expressupdatedata.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://expressupdatedata.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--78d4b2cc-9cf9-5ab9-bc4c-a2ab509c88af","created":"2026-05-13T10:48:00.000Z","modified":"2026-05-13T10:48:00.000Z","valid_from":"2026-05-13T10:48:00.000Z","name":"10ac291868de15712fb32100f25f5c0331fba5e70ef0347b953474d9b153bb81","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '10ac291868de15712fb32100f25f5c0331fba5e70ef0347b953474d9b153bb81']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054514055537152062"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--2c11eab2-dfb6-5928-bdd7-4574fdb2d784","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"ifo-jupyter.natter.icu","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ifo-jupyter.natter.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c36789c-4bb1-55ab-a9c9-162ea07ef7a5","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"https://ifo-jupyter.natter.icu/wp-content/plugins/easy-product-bundle","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ifo-jupyter.natter.icu/wp-content/plugins/easy-product-bundle']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a18529c5-533f-5405-90ce-0f64fd926203","created":"2026-05-13T11:06:00.000Z","modified":"2026-05-13T11:06:00.000Z","valid_from":"2026-05-13T11:06:00.000Z","name":"ce1822f4150fb641b445c3b85f990ecbe68bf30ee3ee2cc8e5e92f45d8ae3937","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ce1822f4150fb641b445c3b85f990ecbe68bf30ee3ee2cc8e5e92f45d8ae3937']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054518692298273011"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4eb2a9e-7a95-5a79-beb0-fc4086d03502","created":"2026-05-13T11:08:00.000Z","modified":"2026-05-13T11:08:00.000Z","valid_from":"2026-05-13T11:08:00.000Z","name":"adaptor-individual-signing-statute.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'adaptor-individual-signing-statute.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054519199704236491"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a87376e8-b1dd-51fa-a65b-e34a6f485031","created":"2026-05-13T11:08:00.000Z","modified":"2026-05-13T11:08:00.000Z","valid_from":"2026-05-13T11:08:00.000Z","name":"https://adaptor-individual-signing-statute.trycloudflare.com","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://adaptor-individual-signing-statute.trycloudflare.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054519199704236491"}],"labels":["opendir"]},{"type":"indicator","spec_version":"2.1","id":"indicator--88b11c03-0475-526f-b2a9-442c839680ba","created":"2026-05-13T11:21:00.000Z","modified":"2026-05-13T11:21:00.000Z","valid_from":"2026-05-13T11:21:00.000Z","name":"kanpyasunfursathemnbashur3498023209.click","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'kanpyasunfursathemnbashur3498023209.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054522495672201542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b8a56bb0-f399-5ad2-aef3-097e04c2ddfe","created":"2026-05-13T11:21:00.000Z","modified":"2026-05-13T11:21:00.000Z","valid_from":"2026-05-13T11:21:00.000Z","name":"https://kanpyasunfursathemnbashur3498023209.click","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://kanpyasunfursathemnbashur3498023209.click']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054522495672201542"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--304fab1d-065d-559d-af64-2a14b5d210e3","created":"2026-05-13T11:42:00.000Z","modified":"2026-05-13T11:42:00.000Z","valid_from":"2026-05-13T11:42:00.000Z","name":"freecoinairdrop-two.vercel.app","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'freecoinairdrop-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054527619958296586"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d16ffe0-7d24-5656-be21-33d9456f089d","created":"2026-05-13T11:42:00.000Z","modified":"2026-05-13T11:42:00.000Z","valid_from":"2026-05-13T11:42:00.000Z","name":"https://freecoinairdrop-two.vercel.app","description":"IOC reported by @CatcherPhishing on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://freecoinairdrop-two.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/CatcherPhishing/status/2054527619958296586"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4c93c9cf-1e37-5368-83b0-3db878286c55","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"intechcloudhosting.com","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'intechcloudhosting.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b6c7dd22-4f44-5dba-ba03-2c27febe76b0","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"https://intechcloudhosting.com/b/index.php","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://intechcloudhosting.com/b/index.php']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3fbcc082-482f-5457-86cb-c77cac4997cf","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"whinypaluza.com","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'whinypaluza.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--76d8ae05-39de-5c87-8fea-e83d2663b7b6","created":"2026-05-13T11:57:00.000Z","modified":"2026-05-13T11:57:00.000Z","valid_from":"2026-05-13T11:57:00.000Z","name":"https://whinypaluza.com/wp-content/upgrade/ceri/index.html","description":"IOC reported by @JAMESWT_WT on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://whinypaluza.com/wp-content/upgrade/ceri/index.html']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/JAMESWT_WT/status/2054531363118710935"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--900ee29a-40e9-5af4-926a-5e79e2a556b0","created":"2026-05-13T12:00:00.000Z","modified":"2026-05-13T12:00:00.000Z","valid_from":"2026-05-13T12:00:00.000Z","name":"xn--2n1b810a1er8ivvcx0yyhc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--2n1b810a1er8ivvcx0yyhc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054532153484955991"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7dcc524c-d128-5a94-80df-605b8222957f","created":"2026-05-13T12:00:00.000Z","modified":"2026-05-13T12:00:00.000Z","valid_from":"2026-05-13T12:00:00.000Z","name":"https://xn--2n1b810a1er8ivvcx0yyhc.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xn--2n1b810a1er8ivvcx0yyhc.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054532153484955991"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b6c7b03-a711-5e0c-a492-55c85c07e973","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9b2aa54f-722c-5793-a98f-e75dddc09252","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"https://c29t1jqg9qfc16yycas6eq0jyhz.live","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://c29t1jqg9qfc16yycas6eq0jyhz.live']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34dc11b9-5120-5e20-9c89-38bc32dd32fb","created":"2026-05-13T12:23:00.000Z","modified":"2026-05-13T12:23:00.000Z","valid_from":"2026-05-13T12:23:00.000Z","name":"9a84358abd65a12ccba385d3ebd4ec6a89c720b29abf31732c479503709d5059","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '9a84358abd65a12ccba385d3ebd4ec6a89c720b29abf31732c479503709d5059']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054538128493555815"}],"labels":["malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58999904-efa0-5fd5-96f9-5370386dc734","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"m365.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'm365.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fdf8a75-5a86-5cbb-a8bc-910053b23503","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"http://m365.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://m365.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd24262e-8b12-56ba-bd29-67d5e268c694","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"secure.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'secure.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0fdf3b1d-ee0f-59ba-826e-49f75ff10149","created":"2026-05-13T13:06:00.000Z","modified":"2026-05-13T13:06:00.000Z","valid_from":"2026-05-13T13:06:00.000Z","name":"http://secure.outsystems-usa.com","description":"IOC reported by @Kb4Threatlabs on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://secure.outsystems-usa.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Kb4Threatlabs/status/2054548803177607219"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b74b59e4-2bf4-5882-b22f-0afc7d7948f4","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"jp-postbank.nmbcv.com","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'jp-postbank.nmbcv.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9896e702-53dc-553e-abaf-4360ab01fe13","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"https://jp-postbank.nmbcv.com/eFtDCclH","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://jp-postbank.nmbcv.com/eFtDCclH']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1fc6dd45-2a03-5166-b1b2-6c5b30aa7e3f","created":"2026-05-13T13:18:00.000Z","modified":"2026-05-13T13:18:00.000Z","valid_from":"2026-05-13T13:18:00.000Z","name":"195.86.16.149","description":"IOC reported by @harugasumi on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '195.86.16.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/harugasumi/status/2054551753295835210"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ffa8afd3-665b-59a8-ad59-0f97f6898c70","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"https://xwjyzxf-jp77.icu","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://xwjyzxf-jp77.icu']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553783603220488"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6592152-daea-5276-9c62-38a538aa4d34","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"http://38.76.199.112/Check.zip","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.76.199.112/Check.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9de36f97-dc30-5a0b-89cb-f35914db182f","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"38.76.199.112","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '38.76.199.112']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5e4215-dbfe-5c51-890e-57f1346d966f","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"8b7ca9f2836e43a5655dafcf5cb8e580e091b341db66d0896a816c96a52aa60c","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8b7ca9f2836e43a5655dafcf5cb8e580e091b341db66d0896a816c96a52aa60c']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553788883849289"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cd7d694-7181-5710-a4dc-f4f3a27cf39d","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"Check.zip","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'Check.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc397f9a-98e3-578c-b406-2e8985dbc254","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"http://Check.zip","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://Check.zip']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5a5c6400-70ef-5524-a35f-0466a25efb54","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"http://38.76.199.112:28888","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://38.76.199.112:28888']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3385cb88-5f42-5957-b4d0-098bd42de60a","created":"2026-05-13T13:26:00.000Z","modified":"2026-05-13T13:26:00.000Z","valid_from":"2026-05-13T13:26:00.000Z","name":"c0c21b0cacc2aed672764d322e2e15ea6dd95dfd06126d0266354a1ecbb1f1b3","description":"IOC reported by @bomccss on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'c0c21b0cacc2aed672764d322e2e15ea6dd95dfd06126d0266354a1ecbb1f1b3']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/bomccss/status/2054553790507073915"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--08988aac-ecab-5ac0-a1c3-2b486621c25b","created":"2026-05-13T14:00:00.000Z","modified":"2026-05-13T14:00:00.000Z","valid_from":"2026-05-13T14:00:00.000Z","name":"secure-univ-antilles-fr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'secure-univ-antilles-fr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054562352188530786"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b851917b-96ce-51ea-bdbc-578831c60192","created":"2026-05-13T14:00:00.000Z","modified":"2026-05-13T14:00:00.000Z","valid_from":"2026-05-13T14:00:00.000Z","name":"https://secure-univ-antilles-fr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://secure-univ-antilles-fr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054562352188530786"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2345009-9ab3-5b21-a491-7d4686da2816","created":"2026-05-13T14:09:00.000Z","modified":"2026-05-13T14:09:00.000Z","valid_from":"2026-05-13T14:09:00.000Z","name":"162.214.153.83","description":"IOC reported by @PhishStats on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '162.214.153.83']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/PhishStats/status/2054564585428935062"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d305968f-c546-5d31-a44e-f15d1252f6ef","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"dinewithuss.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dinewithuss.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a00b8ecc-3e72-5b92-9719-4908a2d5c862","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://dinewithuss.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://dinewithuss.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2a57ebd1-5da1-539f-b0df-1b7c0051d87c","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://130.12.180.40","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://130.12.180.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b67e185e-944c-5fd4-8074-ccc40ecdf713","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"invltecirclle.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'invltecirclle.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--926820b5-c506-5c04-afe4-8ad07cf2b16b","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"http://invltecirclle.de","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://invltecirclle.de']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f697d05d-6886-5d3e-bf54-1a5a2c0afaf6","created":"2026-05-13T15:03:00.000Z","modified":"2026-05-13T15:03:00.000Z","valid_from":"2026-05-13T15:03:00.000Z","name":"130.12.180.40","description":"IOC reported by @naumovax on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '130.12.180.40']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/naumovax/status/2054578232599494954"}],"labels":["RAT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--523710e9-5b70-565c-942e-f1a66d45436e","created":"2026-05-13T15:22:00.000Z","modified":"2026-05-13T15:22:00.000Z","valid_from":"2026-05-13T15:22:00.000Z","name":"firstcitizensecure.vercel.app","description":"IOC reported by @Alopsis on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'firstcitizensecure.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Alopsis/status/2054583063275802835"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e39ea420-1110-5f2c-ac40-c78ae9eb73ea","created":"2026-05-13T15:22:00.000Z","modified":"2026-05-13T15:22:00.000Z","valid_from":"2026-05-13T15:22:00.000Z","name":"https://firstcitizensecure.vercel.app","description":"IOC reported by @Alopsis on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://firstcitizensecure.vercel.app']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Alopsis/status/2054583063275802835"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--12417d75-2781-5e4b-a157-36507e28eed5","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"driect-jabnnka-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'driect-jabnnka-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a67b4ca5-4062-5243-895b-f87a5881e9e4","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"https://driect-jabnnka-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://driect-jabnnka-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--487d0c69-b737-5b39-913c-147af59d1070","created":"2026-05-13T15:29:00.000Z","modified":"2026-05-13T15:29:00.000Z","valid_from":"2026-05-13T15:29:00.000Z","name":"137.220.152.149","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '137.220.152.149']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054584727152345109"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaf205d3-8184-5628-aca7-e93250bc6dc0","created":"2026-05-13T15:34:00.000Z","modified":"2026-05-13T15:34:00.000Z","valid_from":"2026-05-13T15:34:00.000Z","name":"97361a91ba80981ca549ed19b2e2b9250fed6231027cd15418578b3db76b02ab","description":"IOC reported by @smica83 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '97361a91ba80981ca549ed19b2e2b9250fed6231027cd15418578b3db76b02ab']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/smica83/status/2054586126854181101"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9e5bf101-8ca6-5fc2-afc2-8ddffb316ec0","created":"2026-05-13T16:00:00.000Z","modified":"2026-05-13T16:00:00.000Z","valid_from":"2026-05-13T16:00:00.000Z","name":"postnbgf.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'postnbgf.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054592548891508962"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--caed4fd6-0764-577e-9e8e-42f4fba22a0b","created":"2026-05-13T16:00:00.000Z","modified":"2026-05-13T16:00:00.000Z","valid_from":"2026-05-13T16:00:00.000Z","name":"https://postnbgf.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://postnbgf.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054592548891508962"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-13T16:20:00.000Z","modified":"2026-05-13T16:20:00.000Z","valid_from":"2026-05-13T16:20:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054597569158750658"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-13T16:20:00.000Z","modified":"2026-05-13T16:20:00.000Z","valid_from":"2026-05-13T16:20:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054597569158750658"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b69744db-f94f-5ddf-a8ba-ca5b91a0c08b","created":"2026-05-13T18:00:00.000Z","modified":"2026-05-13T18:00:00.000Z","valid_from":"2026-05-13T18:00:00.000Z","name":"btnnthdtrhbhtrhcfgtrhchtr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'btnnthdtrhbhtrhcfgtrhchtr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054622744579318032"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37ad6368-0bf8-55b1-8a48-5a230aace73c","created":"2026-05-13T18:00:00.000Z","modified":"2026-05-13T18:00:00.000Z","valid_from":"2026-05-13T18:00:00.000Z","name":"https://btnnthdtrhbhtrhcfgtrhchtr.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://btnnthdtrhbhtrhcfgtrhchtr.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054622744579318032"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b395b8a9-c8f1-572c-85df-597008bbee9f","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"docinfo.ndocline-st51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'docinfo.ndocline-st51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--08e68c70-6c4a-53c1-981e-55e8c9179ea4","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://docinfo.ndocline-st51s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://docinfo.ndocline-st51s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aca2c5e-08f5-5328-b13d-0e0c35cf4fff","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9001fd97-9e46-542b-86d9-fca24be63abe","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e5052c67-d683-5992-a2af-1eac62cb755a","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"uhmymkd.reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'uhmymkd.reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cfa0bcb-f28e-5ac7-9117-dfb82c630d61","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://uhmymkd.reverifyblogmid0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://uhmymkd.reverifyblogmid0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05265a15-e5a4-5691-8bec-c1e6eab69a86","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13bdfc0c-e6ae-5597-bd12-5cb2088ddfea","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fb020ec-eb14-5e41-9004-cd29bb19df70","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"qxnhdalc.naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'qxnhdalc.naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d0fa27b-b79f-57cd-8e0f-198dbeeecb22","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://qxnhdalc.naveblogedit33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://qxnhdalc.naveblogedit33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f11a28e-35b2-58d4-8f42-3fc2b2da5e6a","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02cf609a-92d6-564f-aaf2-d7e9a1376975","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39d42c90-9af1-5fad-b153-3815aad19ccc","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"mhjwsf.reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mhjwsf.reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cf0c6b3b-e78b-55b4-8ee4-7945d79f44e0","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://mhjwsf.reverifyblogmid19s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mhjwsf.reverifyblogmid19s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054629278256345117"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46d62100-5bc6-5a25-8ef4-45b22f17ddd3","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"nid-navertca.servehalflife.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-navertca.servehalflife.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f19c293a-6de2-5e6c-853f-2cda8ed4149e","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://nid-navertca.servehalflife.com","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-navertca.servehalflife.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5fb6d949-690e-570f-9326-f47d4e3ea1f8","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"http://27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c41e64fd-bb60-5e1c-a8ea-f62b098b645e","created":"2026-05-13T18:26:00.000Z","modified":"2026-05-13T18:26:00.000Z","valid_from":"2026-05-13T18:26:00.000Z","name":"27.102.137.150","description":"IOC reported by @phatomcandle on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '27.102.137.150']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/phatomcandle/status/2054622720541987055"}],"labels":["APT","C2","Kimsuky","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50535afb-442a-5444-8033-4bb69b2fc3b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2568cd95-b7d1-58a3-8333-b77ca29f2716","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8a64e274-6798-570f-b694-266757288958","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e8f065a-4329-5d8e-b905-7de6d4b1b18d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.tpx2ee.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.tpx2ee.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ca1372a-adc1-519b-8267-292de844c34d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a357228a-157d-506a-8a4b-016e6237f9b6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ff5b0a3-9860-55a6-abbf-533829115562","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f43b583b-e1ea-585c-af60-42e886208153","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntpo14ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntpo14ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e5714ce-8df0-5112-aab8-42a8669d4120","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d1221d-eacb-569c-ab58-d0533b4e2ccb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be54bddf-569f-581d-9a23-b0198fe6f4a7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8ba03bfb-0807-5661-8e53-6944ad70f5ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ntpo13ke.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ntpo13ke.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--97f2ed93-7ad2-508f-879d-07bb74dfb256","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1684fcd1-e145-501b-a5b1-76a70f8f8849","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45ea2ca0-28ef-5079-bd06-f53e1086b5be","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f3d6fdc0-478e-5eec-803d-844e6949737f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.htr33ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.htr33ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fedf4c82-0587-5cd5-a731-dcd431ac4e89","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c8efa4d-31f6-509c-b495-195e4a8c0af9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0936daeb-e3a5-5f39-82d5-682b4b91909a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--93684044-f885-5eca-9061-6041869fc324","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.opt38ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.opt38ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--affb609b-ad0f-5a94-8202-0d035a0ba005","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7cbbec75-72ac-5e6a-b77c-606412567a9b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac840956-315f-5fd4-9331-55fd5417814a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c07fc6a2-e880-51e0-9e90-e52ea654a56b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.itx6ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.itx6ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--202984e9-d900-5cec-9aae-e5f9ab22168a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx4ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx4ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cc113f07-db63-56f1-a4b6-1e590af30d0f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx4ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx4ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--797780ce-2032-5a0c-988e-ad6abe9577b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"otx3ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'otx3ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--28b116a0-7229-5d47-b11b-6411b8fd56b4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://otx3ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://otx3ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f47d790-cfad-5d33-af36-2e8403d61feb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78f8afe5-8c12-5cd8-938e-5bff1a356018","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--230890ae-b476-57d7-a183-70fddb9ccfca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8943b9a-c045-54e2-8894-3698c2bbc487","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.opt39ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.opt39ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2d2f3a8-db42-5a92-be6b-09845415bf0a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"otx19ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'otx19ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c2f2e90b-c4de-53f5-bb61-7ad69b96ed67","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://otx19ntp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://otx19ntp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--72f095fe-2394-557f-b316-ed6cf86751c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f81d08b-e742-5554-bd15-a6a635df4ced","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59f531d9-dc2c-52bc-b972-8af9fa230821","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f6f9cb1-5c68-5760-998d-13b69a0df46d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.htr7edc.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.htr7edc.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12eb644-51bd-5edb-aa56-74f09bcab31e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--df539b36-9bc1-5a5f-817f-e3a72a4dcd46","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0046bde3-3de4-5b97-93da-cafcc98a9d6d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39d49e03-f6ab-59f2-b379-1b02f46c20b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.opt36ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.opt36ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aa179fd-50b2-53e0-bcac-42add4e21862","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--87557fb9-6725-50fc-8609-bc5ecfe30a29","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054631705630359914"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--af69701a-d8f2-5a01-a3b6-5c489c2d660f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--37c92d7d-9e3c-5575-8929-ed95dd813526","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.opt5ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.opt5ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8c02807a-aff5-5e3b-aa4f-cb1165d79280","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f3cabee-58b3-53b9-8a9f-5cb029ce0b72","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0110313f-ae73-5dab-8b74-5ef4027ef5cb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--23454d60-4d49-5fc6-96a8-7e4d8194afa4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.opt17ntesx.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.opt17ntesx.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ab1e0c4-ad38-5ac8-b571-9091b018fc0d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr6ies.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr6ies.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2562798-1932-5491-a5cb-57b43c4a36be","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr6ies.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr6ies.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f083480a-7ce6-5b58-a1ad-5c1e26b9d61e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"htr19ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'htr19ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--840fd5bb-afa3-5fd7-a237-7b2cd3cdcbeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://htr19ies.dynuddns.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://htr19ies.dynuddns.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--05c543f0-1af0-5ee5-8876-1c18f24e9645","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--716fba16-d20a-5e82-a7e2-a6703d67dd0b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--587c4695-fc55-5f58-960e-b41e64067062","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--19a53879-d52e-5faf-8256-bd16d828aeac","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.itx26ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.itx26ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf4ce767-90dc-5857-99cb-4c2b529160ce","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--961c11cb-fbf8-5fce-9d3b-c3c6c7a8d72e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f7ce43d9-3f8a-5b25-b62b-9aac5570b107","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--da0ea29b-61cf-5517-b71c-d8770e5f28b4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.trx16nts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.trx16nts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a4f903a-4c4d-5813-bbda-b18354386839","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3aed6ea-6438-55da-a742-0fe09ec8a14f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--235c596c-05b9-595f-86fa-9d51a0ac8ee7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52417c44-75d8-5eca-9bf3-dd6dd1bea454","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.tpx11sdoc.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.tpx11sdoc.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3281d5a-d278-58a6-ba2e-08a93d7b9fe6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"txis3eo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'txis3eo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a030a460-25c8-5a8a-a0f1-2f1c53002bcb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://txis3eo.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://txis3eo.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--52c72774-7836-525f-a570-b1cd008d660c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--98b89c71-f3cd-5d15-9dfa-dc987d4ceede","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a21a6b2f-527d-5b3c-abff-4fb6c867191d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2b00fa0a-5b19-53d5-bdf4-9b578368e9c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.nts19pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.nts19pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7fcc8d6a-2d21-5ea2-b245-342c4bb02472","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67462219-58c8-50d4-95f1-7fd6128d9d0c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--457183ec-46f4-5898-a464-318cfa6eff3c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--610bb3cb-0b08-52bb-9297-4efbaad537c8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.mois11ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.mois11ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2cd7cea-3669-560f-a098-37d567b50570","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntxes18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntxes18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae5cc4c4-5116-5e10-a5f6-bc5f6e9667c7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntxes18s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntxes18s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2babdc92-c565-55d2-8b12-208d9ef78a83","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itxa16ns.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itxa16ns.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36cad630-f6db-53cc-a478-5176ff2180d2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itxa16ns.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itxa16ns.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--99f75d8c-6c59-5b81-bd5f-98d4c7f044b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--71a28e7b-e317-5969-8b6d-1d0b3845e20e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63388418-d77f-5067-8950-7f18cc61cdcc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"itx8ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'itx8ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7009e7a2-eb0e-5093-bebc-27bc3c371a7d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://itx8ps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://itx8ps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--856798d1-532f-55be-986d-2b630326fd73","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68e9e894-290a-58ad-9eaf-c6df43d9bb9d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b098b2c7-419e-541f-93e8-98a121a1f54f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d798e74-c5f1-5c35-969a-45edf9eb9382","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.tois5ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.tois5ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bd4908d2-6940-55d2-9de4-f1def7b8b142","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tpe5ie.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tpe5ie.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--65153266-9000-5c19-8bf5-5b63c65e19c2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tpe5ie.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tpe5ie.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--49ad5ed5-09d4-5b91-b724-44daa486be33","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"tois15ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'tois15ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c378aae7-08e6-538f-b47a-2eef46f070c7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://tois15ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://tois15ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cfc6335-4e2e-582c-83c4-3bf8bbbccbcb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"xto14ic.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xto14ic.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--69d9ce71-010f-5f41-a2a8-c4d5d286d1bb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://xto14ic.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xto14ic.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9bb0ffff-10fb-54ad-bdf6-10e235c49550","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx10sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx10sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42c60311-0c3a-5acd-ac16-e51034552280","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx10sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx10sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6840f72f-b425-53ca-b4f0-07c1f9360ffd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b56d7efb-2e5b-5bfb-bcb3-e5bee577565f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e30b5b0-c5e5-5521-8be2-1265dc3993b6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois0ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois0ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b378c3f-a473-51b9-9f19-8d3c45ea57e6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois0ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois0ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e55c8911-d995-5770-a008-55ddc3487557","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois36ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois36ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--67a2b798-cf43-596e-a200-4235f8796afc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois36ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois36ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fca4ce3e-a12b-50d8-b819-39580a32a426","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9aff5f62-2833-57c5-8667-3505641a7263","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07b8782-855f-504f-9ec8-966889db52b8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"mois39ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mois39ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a105554b-3699-5677-be41-1c5b064756bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://mois39ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://mois39ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3d5d587c-ca4d-537a-bfa3-5958bea5bbc6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cecbb345-2699-5b76-852a-6755b39295df","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.mois26ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.mois26ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--623ca415-0d24-5806-b64d-85099888cdc1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3888138d-6c65-57de-a29e-fac8ac85bdb0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.mois22ex.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.mois22ex.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3243689-40b5-59cc-9f62-37339fc7c6ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nsc2tx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nsc2tx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e4caddaf-549f-5581-8b89-4bee463dd7b1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nsc2tx.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nsc2tx.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2fd30dbc-6a06-5702-87fe-63d7342b3fe0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op10ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op10ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--190d6dbf-8ebe-524f-ba56-c340b1117ab3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op10ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op10ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c21b8740-6c35-5471-be80-3a42626a6236","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c92a457c-676c-5b5d-bd28-eff964153e6c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.nts9pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.nts9pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fc636ba5-3cd1-52e2-8875-3c411340d25d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op11ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op11ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e6b8fa7d-ff80-5c12-a286-2402ee2bbe41","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op11ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op11ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a746684-838a-5daf-84ed-2965e395fe00","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op27ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op27ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--deaf6e74-1e3a-501a-a4df-a86b9101378e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op27ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op27ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a55124a9-a2ca-5af9-96a8-3bdde20d0148","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op34ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op34ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--de157869-678e-5476-bed9-fd289ae1c32e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op34ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op34ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c971113e-3198-5084-b4d1-005f398aff16","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op30ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op30ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6a553635-69d0-505c-828b-a78c0c3c5569","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op30ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op30ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--55d8c8a4-90f6-5dac-9bee-998820bee05e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op15ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op15ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1aea4517-e128-55ed-ba92-e2fcb7286ca7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op15ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op15ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1e989cd4-a347-581f-94e8-e428f4ce6c5e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op36ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op36ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5135c64-556a-5f7d-8ec2-5b006257262a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op36ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op36ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c95fdf1b-2ba3-5702-ba29-a5f4d42486ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op19ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op19ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c27b856-6f7e-5591-abf5-186846c7f8c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op19ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op19ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c95b6e8-5477-5279-a695-11153ce4a750","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op17ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op17ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7760faad-2cba-55e0-8a4a-91be6eb4236b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op17ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op17ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4f619bcf-ca2b-5d3e-bf55-d371a4fa9a70","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op24ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op24ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be3dd43a-6f9c-5186-8bed-eb41d34cd750","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op24ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op24ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--716a246b-28b2-5046-ab03-623616b3fa5b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op22ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op22ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b46f20d-6492-5056-8733-ea709b2bdb97","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op22ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op22ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--432060d8-0ad7-5911-8058-adc44e74cb7a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op28ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op28ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34e2963b-4537-5675-a073-9ff0bb7d20fa","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op28ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op28ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f8c809ea-f0be-5d82-8727-1558a3fd539f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op35ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op35ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--11328a39-1590-580b-b7d2-86aad8506776","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op35ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op35ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4a26c6e3-bd40-537e-bfb5-80094972c61d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op29ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op29ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3172b261-5ff8-548c-b2ae-a03b3fed3967","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op29ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op29ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6146ccc0-2975-5d30-9900-c944e6c0f69a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op25ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op25ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c231db1-1f0b-560e-8c56-faf9c4ca5ac9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op25ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op25ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4bfc66c1-379e-504e-ba6b-2eb5af4af14b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"op12ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'op12ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4849f5d2-848e-5b59-a503-35975ccd3cf2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://op12ntyx.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://op12ntyx.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf15a34-0948-51b8-b1fc-6a9229b90c6e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts8pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts8pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c77db810-00a6-54a8-9e86-f28835ff2080","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts8pops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts8pops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b984b67-bed8-5cc1-97b0-3cb4ef1d475d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a4f07b78-30be-581d-a031-1a4521ff924f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d1a891b-eab5-5029-b72b-e1392cc437bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--66a00bf5-ef70-512a-a9e3-2dc63394a837","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.als22nty.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.als22nty.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cdf29a97-08d9-5eef-a998-909e68bd5884","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0813a96-d42d-52a3-99bb-0758819b9a94","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22cffa7b-b968-5bea-b1bb-c38a455b0520","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68238c67-fd10-518d-8624-ee65e4d41c8b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31b1c247-b954-5a0e-963f-1513acd8b527","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--68f5f5e0-4607-5b4f-832c-b41f28c407af","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navipdes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navipdes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5e48ae7-1041-57ad-a73d-198dc96d729e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8992882-cc99-5eed-9efb-5e3f377f8e11","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7429f3ad-1b25-5e6f-bb66-0201dcc24465","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--924e46c0-639a-5590-b7bb-55ca44658463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntx25sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntx25sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--34ea1831-d488-58c9-97f8-9e033785e9db","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eef8580d-a037-5836-b519-12621bce7ab8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6655e4fc-68f8-5928-ab48-971c44720e84","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--799a7c41-d9ab-5fde-9cc7-97f47fed7df1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ntx24sp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ntx24sp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ec4c03d6-f3c4-5217-87a7-73eaf1d5bfad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7af229f8-ccd6-5238-9d5d-c0d37d6c8be9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0341ff48-9041-5d0d-ae9a-d8979dfafc3c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp32s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp32s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--61b6e22b-3913-5a1a-a869-1308cc1aa0a5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp32s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp32s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d64bbfd-fa2d-5b4a-a3a4-1af173028fb9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bbeaf34-1337-52b0-b3cf-8d8e8f0cf81b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp39s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp39s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ef92f7d-660e-546d-956b-a6fe4a53279b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp35s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp35s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c563cdb1-06e0-5a44-9c33-83fd015aeb98","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp35s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp35s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04bc7b1b-bb88-51ab-a60d-f2cf48b1d4e5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--415ec302-98ad-5756-9dff-72e3397d8c3f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5de7dd6-1d06-5c63-806c-80aa3e7469e6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b47951-77c0-572a-a28b-28304ae8d219","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a2ad66fb-2cf1-58b6-8640-3f86c3fba069","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp17s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp17s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bec4bcc1-f4e1-5fdd-852b-c7d4705f7e69","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp17s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp17s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--64449ede-35ab-5add-8584-380b4efcfd99","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp11s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp11s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3096d162-3e76-5616-bafb-068b7fe5038e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp11s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp11s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0bbab365-725a-5532-9c06-37823c1daaeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f21220b-1cb2-5497-8844-d2d584536aca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3ff1b4f-56fd-5990-92ed-751fdddd1bd1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp9s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp9s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0dc4200d-bcd2-5edf-954c-9fc0afb30b0c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp9s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp9s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f19de688-bb0a-5078-987d-a8871f619920","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d05d44ca-c9e2-5dc7-b1a1-5f4b10e67ad7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--13311450-6b00-5cb5-a8aa-cabc10be20af","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--518695d8-146f-55e7-ada9-ea01438ba77e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp23s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp23s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bdc686a-7850-5581-9852-3cf2214841ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp37s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp37s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07cba164-35f0-55ea-b250-9faa43bcaa75","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp37s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp37s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6f193b22-ace5-53e9-b1da-8e5b619b6882","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--58c0e8c0-8743-5140-8831-2c775af810c5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0c3bbd14-c6df-53a7-a2d7-264c40ae445d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp21s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp21s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9f32f847-1fbb-5394-a606-eb8c6e783c30","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp21s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp21s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5628195-aa11-54ef-96d5-887473a29874","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp6s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp6s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9cce77cf-6199-55a9-99fc-0e6fc409d3e2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp6s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp6s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d8c3399a-33cc-5f43-8c16-53bac9d98b15","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp4s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp4s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--57699688-5964-52b2-94ed-0d56abd247b5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp4s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp4s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0caadb30-1d96-5bbf-972e-248a6544eebc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxsp8s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxsp8s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ff629d9-4524-50d2-9cef-551497a2d5d5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxsp8s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxsp8s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ce1764d3-65b1-5aa6-966d-c869d5eeee52","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntsr27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntsr27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c4922d2-5fde-5b14-ae67-59fe971d6445","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntsr27s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntsr27s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--31d8c48e-ec05-5c77-9e9b-b2f156f682f4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"xn--n-cop-iyu.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'xn--n-cop-iyu.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7a5cacb-de53-572a-9983-caaf87cdb98c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://xn--n-cop-iyu.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://xn--n-cop-iyu.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1ce6c243-b4bd-5f72-bf71-647fb1752e2a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"n-crop.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n-crop.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--335f818e-2bf6-504b-b1b9-c8994bc06914","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://n-crop.anav.iposepo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n-crop.anav.iposepo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1b8e8dc0-f88a-5e74-8a99-f48a0899e7b0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d71044b6-691c-5943-91a0-4dc6c97b857d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos28s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos28s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b0ca250e-eed8-5c56-956e-3d20d0e2f1c1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"pntxes20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'pntxes20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0a30dcb7-91ae-50aa-b6c6-2ead9c4e8324","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://pntxes20s.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://pntxes20s.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d6b86bee-8459-56c3-b916-e9906a62e2bd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6cf8f318-27ac-5ffb-824b-74a522ddf85b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno31s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno31s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--961a9e08-4513-5b87-929a-06c5980507ef","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--42ba81e3-56c6-5e38-b33a-42b259e7ea40","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno5s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno5s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e7f3a51-1ae8-56a0-ac86-b7875224ed2a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno15s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno15s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5dd5464a-585a-5894-a916-451b364c5836","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno15s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno15s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--82be1c02-296d-5bc0-8218-066fde69ff6d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipseno10s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipseno10s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--315f3bc3-0e9f-59e0-8c7e-6a3b9747082b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipseno10s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipseno10s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb4e65e9-71f6-5c38-acbb-1eb21ab0ded1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxdoe0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxdoe0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a901ee67-cfca-51ee-afba-84b42d9fed8c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxdoe0s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxdoe0s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c61efd61-3c77-59aa-835b-2de4a04426a0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos38s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos38s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84fb5111-2b65-5995-a1e8-de90f1d39e25","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos38s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos38s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3cfcd76-acf0-5168-89e3-c20cc945cfb3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntxdoe2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntxdoe2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5651e90b-30c2-58c7-ad32-41b9f6ca421f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntxdoe2s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntxdoe2s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--00c615bd-747a-5e33-b722-0599b74ceed1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ea3390-a83a-5b97-ad52-71a30ae80c19","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos33s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos33s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3a9feb7d-affb-507d-b116-a0a79eacecab","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ntrsdos3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntrsdos3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3efdaeef-a72d-5e94-b639-6c7190145463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ntrsdos3s.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ntrsdos3s.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4af99b6-689f-54f3-b301-d0d1307a73c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.bnav.iterpost.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.bnav.iterpost.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6c012499-f7e7-573c-8cfa-c89a34891fbf","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.bnav.iterpost.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.bnav.iterpost.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63a03276-3a6a-521f-95a0-8d1602eb8493","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"n-store.enav.ipspcoep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'n-store.enav.ipspcoep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--78e347ee-c9fa-5735-b511-02684c3d7ba1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://n-store.enav.ipspcoep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://n-store.enav.ipspcoep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b3d3801-3ab6-5a99-935e-e542b3662123","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--be5255c7-64e5-5298-8091-2463d0e7abb4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--abf1295f-87bd-5c4d-8a2e-35d7fd68bfff","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e3e95d3b-4b75-5223-a508-6c87108274fc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a26cd03d-c68f-5a39-8989-99d1bd99376e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.cnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.cnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c593a4b5-5a2d-526e-98da-858388c272f4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.cnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.cnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b22293f5-6ace-5837-98d4-e0f040bb3238","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.enav.ntxthom.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.enav.ntxthom.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3721d9f6-eec6-5322-95e3-8be4cbdbb4f8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.enav.ntxthom.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.enav.ntxthom.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c10275e-9a8e-562f-8d50-26a20f0540bf","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.anav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.anav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3ec17b2a-ec80-5820-9584-21d33fb1cda6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.anav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.anav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8bf73ed1-5159-5dcc-8224-9c8c31bfb5e8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d255922-9e17-57f3-b90d-d34ab883cf3d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e61d79d4-07f3-5d7e-8bbf-23f388e1a1fb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4639c5da-0542-5a3b-bb90-1f1cefa8fa11","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2e5c1dcb-40f8-5f04-9421-cfe1ca02db08","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.cnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.cnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4feb992a-8db3-5223-b8a8-9bbcdb37b072","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.cnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.cnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6ebd2e45-c8a0-5870-aa9b-f17bcde814e1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--20a8648b-077d-52a7-92a4-d6b10c3cd885","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.bnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.bnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d558940d-3e10-590c-bbdd-f0ef9253e656","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad39c849-a399-50fc-b8ff-2b6728dc1aa1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6e6c222f-b3a7-548c-8b51-1c4710430840","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d053e531-e5d4-5cf2-8da6-eae67c8c9312","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.dnav.ntxhosts.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.dnav.ntxhosts.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ac2af067-7e4f-547a-8569-10f6ba6f18a9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f09d16f4-251f-5fcf-a8f3-b5210fc40da6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dnav.htxcpy.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dnav.htxcpy.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aaec2a5d-4a9e-51b2-9351-ee6afc760294","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c3f10bf6-1429-5565-a382-fa9c659e2fbd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--561a1558-f165-5eb1-b6fd-bec9a7823cde","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e8c40199-27d6-5731-af8c-a38fa6885071","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.dn.ntxals.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.dn.ntxals.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--696060b0-b0e2-5818-910d-576ac178c578","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.en.ntopeds.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.en.ntopeds.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--27eb145b-65ea-5475-8e94-271c288b76f6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.en.ntopeds.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.en.ntopeds.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4034ac8a-f428-5fd4-9e01-d863ccca0984","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-servers.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-servers.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--911c45fa-e68b-53a5-b994-63c0a8ce2efe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-servers.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-servers.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3775727d-25fb-5173-89e3-a2612c7554ff","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navorlogins.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navorlogins.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9bf8c82-dcee-5291-8021-4877cff125ce","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navorlogins.doc-ips.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navorlogins.doc-ips.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2cc51da3-22d7-5c88-b5a4-b1a0c91c464b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.an.dpsipes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.an.dpsipes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d2d79e3-6185-5849-bbd8-f194e211e3ed","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.an.dpsipes.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.an.dpsipes.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50fb40d7-c026-5e8a-ac72-c357de0a440e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.cn.cofipdo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.cn.cofipdo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ae30f4f4-de62-5ae8-b286-08301a53fd28","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.cn.cofipdo.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.cn.cofipdo.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63bd5668-a791-5db2-9403-3d35955926d1","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.cn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.cn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f0b373b-a3e0-555c-bdcf-7751b87f7b39","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.cn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.cn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--efe22b70-9071-5d88-b2b1-4b5739c3036f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.dn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.dn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14576f13-5e2b-537d-9007-4abf6c0d1a69","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.dn.ipsnvlep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.dn.ipsnvlep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b94cb84-6114-567e-b796-b75d19c12b5e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--022338db-2a7f-520e-8a49-627a6822cf2e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd28fb48-0f6d-5652-a468-9b817bf98705","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.an.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.an.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--287619a4-b9d5-5d81-a141-661610e62e7a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.an.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.an.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--29a9be54-c146-5487-881b-4908e6348cdb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.dn.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.dn.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3db15217-6534-5ed9-a93b-7c6b33cd481e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.dn.ipsnvep.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.dn.ipsnvep.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4363a157-3c14-5e2c-bbd2-34d37caed73e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navlogs.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navlogs.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0e2585c2-80b2-5cc2-8a42-8beeffea70c2","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navlogs.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navlogs.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d4297ad-475b-5b7a-b2c7-169de8230250","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f42b207-f299-58c2-befc-1dc0d59050eb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8411877b-2cdb-5c16-a4a9-7e54df5c40ca","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18163e56-cbc9-56e6-af0d-8e69dda4f634","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--786f7a45-c122-50e3-a525-87260a008899","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nides.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nides.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--143faf89-1870-5749-bb04-2df10bad57c9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nides.moisalap.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nides.moisalap.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9094b6b2-fd0d-55f4-bdf4-be78c923fbf3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3666b1e0-9b6e-52b5-895e-b5072beafca4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--50b459fa-5c70-50bd-8d5f-4ff48d243024","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.en.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.en.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ba2e4c4-e2b9-5508-9e8a-ab7b96a98ab5","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.en.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.en.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f0d88f2e-1980-5c17-a18c-2b7bb7546130","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e01fe71-37d8-5c5f-9192-119e22b92cd8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bfe0baf-71f6-5bb7-99b2-adfe1706128c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e380a9a1-dcba-52fd-9955-a3d68f6da97c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.moisnoticed.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.moisnoticed.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f899575-760f-501d-b924-a230395c1071","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.napses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.napses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c158f879-7b25-5f04-a78b-b6d8a09e48a7","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.napses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.napses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--229d7db8-8c35-5a65-a566-1805c68c99d3","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e9e734a6-ee7c-5bdc-9fee-24085d48eb33","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2225dfda-970c-5891-bbb6-1402fd72043a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2dffc3e7-5365-5e18-85f6-d05c9b466118","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--86ff0e0d-dbd4-5c55-938f-4e269afb959e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"random_switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'random_switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--090e971c-7b4f-588a-9077-0e678e07eda6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://random_switch.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://random_switch.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6587d0bc-66b5-589b-b2bb-a1702db91255","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8f6382a6-99e5-5084-92b9-038ccf5e415d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navripses.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navripses.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb6b9094-e2a7-5839-a2d9-e11b8b8fa92b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1ce30fa-7473-523e-80c8-f8c84bb037fd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--eb6b9512-89c9-5c34-ae72-ad505429dbf0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8b509e6c-182d-5486-a74f-d887bd40314e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4dbc128b-06d2-5a02-bcf9-94b1ae335103","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7f54144c-cab1-5abf-8422-e571e91124ab","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5c3e03e3-ea92-5d63-85e1-e483d1fe6580","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ba5ee5f7-cd06-5b85-b394-ea073a1ff3bc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--096f621a-8bea-521c-874b-30a8cd03cdfe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--18874a46-5312-5ade-9f95-2e7125b9e213","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.nedotps.dns.navy","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.nedotps.dns.navy']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fa0e5809-b4e7-5ee0-888c-52694de13463","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"navs.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'navs.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5e03b760-3555-5e72-9e3d-ae0d236ff9fe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://navs.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://navs.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f5785d8c-2b7c-5155-8524-3fb2253de57e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--aea4cc9e-5a1d-54ad-8fdb-eee5308ecee4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b570c34d-4845-5f41-a6da-bdbe5c4c9c64","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--40eac9d6-f709-53a3-9cb4-e045f09b6f2d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b203d94-71f1-5c08-b276-8a39c24764f8","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1caeaa95-247b-5b79-b064-2d704f5767fe","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1a190fe1-08d4-5139-aa14-e7f73d27b668","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e12444e6-36dd-54bc-a952-8351c9d48100","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5bc39afe-f89e-58f6-bff3-0afc2eee7ffb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidlogins.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidlogins.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ddb77648-8813-5dab-94dc-5a4908695230","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidlogins.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidlogins.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d844df7b-7306-5856-940b-0db18e1ada53","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidloes.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidloes.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3252cc6b-7a7d-5676-9c3a-5a335d51587e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidloes.navedtops.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidloes.navedtops.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e058061b-e27f-5411-8386-3ef5a464d3df","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--1c9b410a-8562-5aae-bc0f-18b2fd40e6dc","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0779ed53-5c4d-52b4-88e9-2bd14e3fc727","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ndocs.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a245dbee-af99-51df-98ce-a214cf9c023f","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ndocs.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f76dfb03-32ef-5302-b91b-4c01bd4f1097","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bf99978c-dbb5-504f-8e97-926952a50a7c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.an.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.an.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d444bc37-81d0-5e98-b2c8-db1822525e57","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ninvoce.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoce.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--302d4c87-8eac-56ea-9b3c-93d84bbc86e4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ninvoce.bn.ntsotp.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoce.bn.ntsotp.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--59665f20-613a-5abc-898f-79b4fc7c5b35","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nesever.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nesever.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07fc2f17-0bfc-588d-806a-f8786134d038","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nesever.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nesever.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--22b442a0-c027-5b89-ad83-56b2a47f9d8a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ninvoce.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ninvoce.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee3bf4cb-0662-556e-b063-6a4937276f7e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ninvoce.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ninvoce.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--39397fef-7eee-5b98-b5c1-89ff74c1c097","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidserver.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidserver.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--910f2557-a64d-5579-9556-916615897432","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidserver.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidserver.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--fefd7951-c6e5-53dd-89d0-41c52eef3b70","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nts.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nts.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6b8b3d78-82fb-5014-8b9a-04e16dcabca4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nts.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nts.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3af7abb5-1caa-58d5-aac0-ab5d12fca77e","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ndocs.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ndocs.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3e95360e-1f5a-5b61-ac2f-4d389bc47f7d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ndocs.navrrps.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ndocs.navrrps.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--60218afd-4a24-5ce0-b46f-9a65bad0fb45","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ad1212a2-1190-580b-a30c-22bde039b934","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.edocesnavs.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.edocesnavs.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--823e8218-f208-55aa-be6f-dea855737eb9","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--45d7d0a9-8ee9-5d4e-a402-cff56b23c415","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--dc95c00f-fd40-545e-8ac6-c60d67652dbd","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bed78b2d-0c07-518e-b788-723f31338fc4","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d0a5ec9-6183-536e-a3f6-b7693e5f4495","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d07aa10d-1647-5582-bb65-99187d44cf7b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e34521f7-c145-5776-964a-a0a8d69a3b5a","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7f67927-bcf4-5db4-84d2-c81308f4ce4d","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0766f9d2-e24d-5740-81e0-cb015559246c","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--936500cb-4933-5acc-97ef-7b03a286be76","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.ipscorped.dynv6.net","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.ipscorped.dynv6.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--54ec2426-7795-56d9-a432-ecb8049d4561","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nidservers.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nidservers.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--805cf46a-5ccb-56ad-8c3b-949f395dcba6","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nidservers.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nidservers.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d69b4b05-03dd-5aa8-b88f-0a0ed16b0b44","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nids.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nids.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--affaca0f-d004-5496-acc2-b7f9061890d0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nids.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nids.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--6affec29-1876-58e5-bc05-58d2e5c27eeb","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nida.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nida.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d4e6f581-f4b9-5120-9f9e-981e966d2d41","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nida.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nida.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7a76c5d9-8356-547b-a9f3-b52cb468b15b","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nav-logins.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nav-logins.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--04d359a7-16f1-515b-abcf-57f6348b8f83","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nav-logins.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nav-logins.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--63931c7e-3879-5f3e-bd5d-a6eaa35254f0","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"nid-login.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'nid-login.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e2a55560-ef1b-5270-8d17-72b36b1837ad","created":"2026-05-13T18:35:00.000Z","modified":"2026-05-13T18:35:00.000Z","valid_from":"2026-05-13T18:35:00.000Z","name":"http://nid-login.ntdinvocie.dns.army","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://nid-login.ntdinvocie.dns.army']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2050283519348261205"}],"labels":["DPRK","Kimsuky"]},{"type":"indicator","spec_version":"2.1","id":"indicator--09ca9c85-83f0-50a9-9d8b-6c781198c580","created":"2026-05-13T19:08:00.000Z","modified":"2026-05-13T19:08:00.000Z","valid_from":"2026-05-13T19:08:00.000Z","name":"http://176.226.230.116:38215/Mozi.m","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://176.226.230.116:38215/Mozi.m']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054639827790815397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4be1a286-430b-5fe3-a8f1-66451bafe812","created":"2026-05-13T19:08:00.000Z","modified":"2026-05-13T19:08:00.000Z","valid_from":"2026-05-13T19:08:00.000Z","name":"176.226.230.116","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '176.226.230.116']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054639827790815397"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a42dfe25-1176-5f90-8e5b-bd76be6877b3","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"http://142.248.80.144/lol.sh","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://142.248.80.144/lol.sh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--172f03b4-a27c-50be-9793-c6c040e17dca","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"142.248.80.31","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.248.80.31']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e56546b-46fe-5f7d-947c-f923469f3fd0","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"142.248.80.144","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '142.248.80.144']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0f8ed644-a407-5104-a597-9940ba1ccf1a","created":"2026-05-13T19:13:00.000Z","modified":"2026-05-13T19:13:00.000Z","valid_from":"2026-05-13T19:13:00.000Z","name":"8ae5e4a4c875e45975faf989dbf83214","description":"IOC reported by @sicehice on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.MD5 = '8ae5e4a4c875e45975faf989dbf83214']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/sicehice/status/2054641255133458854"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b191dcb5-9de6-5f60-a48d-6e5f91a93100","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://179.43.177.220:8080","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://179.43.177.220:8080']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--0511db0f-4ccb-5077-9f2f-ccb511f98385","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"cdn.bgpweb.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cdn.bgpweb.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--5f39d916-65d3-57ed-99d7-f50b946a51e9","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://cdn.bgpweb.com","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cdn.bgpweb.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2f3168d6-89b4-5510-9cc4-a3c62036ec49","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"timetrakr.cloud","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'timetrakr.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--ee00ae3f-c7ec-5cd8-a874-849c2cab0a46","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://timetrakr.cloud","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://timetrakr.cloud']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--94ea2ee3-b4ba-5c47-bc96-94b8c35ce380","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"timetrakr.sbs","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'timetrakr.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--4d1ed258-4caa-5540-8172-7dbdfadd6a75","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"http://timetrakr.sbs","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://timetrakr.sbs']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--bcb436ff-d2de-552b-8524-806d48c608b5","created":"2026-05-13T19:19:00.000Z","modified":"2026-05-13T19:19:00.000Z","valid_from":"2026-05-13T19:19:00.000Z","name":"179.43.177.220","description":"IOC reported by @500mk500 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '179.43.177.220']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/500mk500/status/2054642760339112203"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e00088e6-fc94-56d1-97ca-0318d2bbed3d","created":"2026-05-13T20:00:00.000Z","modified":"2026-05-13T20:00:00.000Z","valid_from":"2026-05-13T20:00:00.000Z","name":"bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054652938425876792"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--02ced8a7-74a2-58a9-8d33-949aa4d5dca7","created":"2026-05-13T20:00:00.000Z","modified":"2026-05-13T20:00:00.000Z","valid_from":"2026-05-13T20:00:00.000Z","name":"https://bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://bafybeidwoasanek4d77b4wzkmfz3j2cj4zidyqm7jj6a6636lnx2e5i7ie.ipfs.dweb.link']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054652938425876792"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--b3d51458-5c5d-5d23-93b3-1ba76b552187","created":"2026-05-13T20:51:00.000Z","modified":"2026-05-13T20:51:00.000Z","valid_from":"2026-05-13T20:51:00.000Z","name":"driect-shk1na-c.com","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'driect-shk1na-c.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054665909990834656"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e125b5be-fb69-598b-b4fe-919957fff485","created":"2026-05-13T20:51:00.000Z","modified":"2026-05-13T20:51:00.000Z","valid_from":"2026-05-13T20:51:00.000Z","name":"https://driect-shk1na-c.com/htm/sh1n/selectState","description":"IOC reported by @kubotaa3 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://driect-shk1na-c.com/htm/sh1n/selectState']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/kubotaa3/status/2054665909990834656"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--07e44262-7afd-5fd5-858c-966503fbe0c2","created":"2026-05-13T22:00:00.000Z","modified":"2026-05-13T22:00:00.000Z","valid_from":"2026-05-13T22:00:00.000Z","name":"correo-issste-gob-mx-owa.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'correo-issste-gob-mx-owa.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054683139654479996"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--341d42ee-26cc-5d0f-bd50-71234b88b02f","created":"2026-05-13T22:00:00.000Z","modified":"2026-05-13T22:00:00.000Z","valid_from":"2026-05-13T22:00:00.000Z","name":"https://correo-issste-gob-mx-owa.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://correo-issste-gob-mx-owa.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054683139654479996"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7c70b7fe-84b3-51ad-babe-ee4fae19d947","created":"2026-05-13T23:05:00.000Z","modified":"2026-05-13T23:05:00.000Z","valid_from":"2026-05-13T23:05:00.000Z","name":"rakuten-card.gfhrtt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rakuten-card.gfhrtt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054699527420973255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7df504ff-aa63-5efc-ac5d-cbfec9fa31f6","created":"2026-05-13T23:05:00.000Z","modified":"2026-05-13T23:05:00.000Z","valid_from":"2026-05-13T23:05:00.000Z","name":"http://rakuten-card.gfhrtt.com","description":"IOC reported by @skocherhan on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://rakuten-card.gfhrtt.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/skocherhan/status/2054699527420973255"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--36a07678-6b71-5595-8109-c26c75cf7ddc","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d9cea1be-6b4b-5a45-a415-66ca70ddd034","created":"2026-05-14T00:00:00.000Z","modified":"2026-05-14T00:00:00.000Z","valid_from":"2026-05-14T00:00:00.000Z","name":"https://biglobemailservice.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://biglobemailservice.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054713353105244205"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--84a3ecf8-8b0a-5ca5-b0b4-13fa8b495302","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"hhxpvpo.bond","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'hhxpvpo.bond']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--7b5bcd34-5be0-5e0c-83ad-618803d92f40","created":"2026-05-14T00:36:00.000Z","modified":"2026-05-14T00:36:00.000Z","valid_from":"2026-05-14T00:36:00.000Z","name":"https://hhxpvpo.bond/source/A9QLGXnyX47T","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://hhxpvpo.bond/source/A9QLGXnyX47T']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054722396893122799"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3bc9ec7c-3378-5b53-8fa1-5f4c8ca807ce","created":"2026-05-14T00:44:00.000Z","modified":"2026-05-14T00:44:00.000Z","valid_from":"2026-05-14T00:44:00.000Z","name":"d08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'd08b9af78ec25b65523967d2517d4d9d8dcd1068fca605288462cfd968ef5aee']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054724510319079833"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1f796f6a-57b4-5f5c-bac5-d33cfdc51403","created":"2026-05-14T02:42:00.000Z","modified":"2026-05-14T02:42:00.000Z","valid_from":"2026-05-14T02:42:00.000Z","name":"http://github.com/happydream9028","description":"IOC reported by @MalforsHQ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://github.com/happydream9028']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/MalforsHQ/status/2054578037438517524"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d1a41da7-c51b-5dca-a5cd-4426574038f6","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd04462f-c234-5aba-9fdb-c77e05655944","created":"2026-05-14T03:43:00.000Z","modified":"2026-05-14T03:43:00.000Z","valid_from":"2026-05-14T03:43:00.000Z","name":"http://beachjiujitsu.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://beachjiujitsu.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054769662580379837"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--9d72e7ba-2e92-5e36-9e6d-d6ee85ef4357","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--46b5db09-66b3-5a4d-bdc8-b07143967404","created":"2026-05-14T04:18:00.000Z","modified":"2026-05-14T04:18:00.000Z","valid_from":"2026-05-14T04:18:00.000Z","name":"http://cherepahanataha.com","description":"IOC reported by @masaomi346 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'http://cherepahanataha.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/masaomi346/status/2054778413232353488"}],"labels":["infostealer","malware"]},{"type":"indicator","spec_version":"2.1","id":"indicator--e96f6fd1-a07d-50d0-a760-f9291277ab94","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"mem.calcuttaswimmingclub.com","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'mem.calcuttaswimmingclub.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d15352cd-2491-5d50-9ef1-de2c316bfc07","created":"2026-05-14T05:00:00.000Z","modified":"2026-05-14T05:00:00.000Z","valid_from":"2026-05-14T05:00:00.000Z","name":"https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/","description":"IOC reported by @AddressIntel on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://mem.calcuttaswimmingclub.com/it/pagopa/log/msdpweb/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/AddressIntel/status/2054788822571815004"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8eec0043-844a-55e3-8129-41238ea20650","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"ntc-firewall.safeurl-content.online","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'ntc-firewall.safeurl-content.online']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--c325afa4-7bb7-56ad-98ac-ac46f99d60be","created":"2026-05-14T05:15:00.000Z","modified":"2026-05-14T05:15:00.000Z","valid_from":"2026-05-14T05:15:00.000Z","name":"https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh","description":"IOC reported by @__0XYC__ on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://ntc-firewall.safeurl-content.online/opx/mailflair/r/EZ6n6FMhSh']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/__0XYC__/status/2054792675887382660"}],"labels":["APT"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a7c2c796-db9a-5ab7-a427-bff692eba675","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7ab1e309-aac0-532a-87d7-3d79ed7f0423","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"https://login.lbbacx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.lbbacx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--873a7e6d-25f0-5690-8ad6-b315090b4c79","created":"2026-05-14T05:49:00.000Z","modified":"2026-05-14T05:49:00.000Z","valid_from":"2026-05-14T05:49:00.000Z","name":"35.219.189.153","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.189.153']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054801373880066388"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7661862-fa29-5f74-8fbb-4a75ad442c72","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--f72bc547-4d0a-5e78-86d2-b025286f8b51","created":"2026-05-14T06:00:00.000Z","modified":"2026-05-14T06:00:00.000Z","valid_from":"2026-05-14T06:00:00.000Z","name":"https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com","description":"IOC reported by @urldna_bot on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://wemailacmontpellierfristatic0110nalldomainlayoutoginbleg.weebly.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/urldna_bot/status/2054803961001939254"}],"labels":["phishing","scam"]},{"type":"indicator","spec_version":"2.1","id":"indicator--3c974e11-2703-50fe-8a25-33b449c49d9e","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"194.163.148.133","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '194.163.148.133']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--2d5336b3-34a5-5c72-b96a-b12aa197562f","created":"2026-05-14T06:06:00.000Z","modified":"2026-05-14T06:06:00.000Z","valid_from":"2026-05-14T06:06:00.000Z","name":"892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '892aa7559852a22b8bc7a38df7c2f2cdd866e4c28a8177d80df6190d2eb6a78b']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054805615269298684"}],"labels":["stealer"]},{"type":"indicator","spec_version":"2.1","id":"indicator--44da8abc-989e-5b37-9f57-f2cf025a62dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"rqvzkqb.shbllgs.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'rqvzkqb.shbllgs.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--90b621dc-1602-50ed-ac69-2fd26b0a16fe","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://rqvzkqb.shbllgs.cn/pkkjp/aenop/potyunde/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054806822914232688"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--8d4f3048-0623-5cf8-9c7f-c2e6b826f4ac","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--479de88d-3bc2-58d9-9258-a5dbe57191dd","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"https://login.ztjbbx.com","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://login.ztjbbx.com']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a552f54c-fb54-55f6-8b82-a96e78ba67bf","created":"2026-05-14T06:11:00.000Z","modified":"2026-05-14T06:11:00.000Z","valid_from":"2026-05-14T06:11:00.000Z","name":"35.219.141.232","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '35.219.141.232']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054806913192542562"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b5d838f9-3389-54c6-8aff-6e732460c86b","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"172.239.129.158","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '172.239.129.158']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c8996fe5-fdd0-5d2a-bd66-d670f6c74fbb","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8a24907655a03f0f8b4991cb22a07c4f9e16626260f6dbcc748fbb4dc4720508']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4e0d2148-eb2c-55fb-ba5a-c97f048e0820","created":"2026-05-14T06:14:00.000Z","modified":"2026-05-14T06:14:00.000Z","valid_from":"2026-05-14T06:14:00.000Z","name":"8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0","description":"IOC reported by @Fact_Finder03 on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '8f2e5ee9a87752e1b0626dd2bb754aaa2f9d8ef19d3ae448a06d3c38e647b6d0']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Fact_Finder03/status/2054807559404732926"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--7035da5c-f6f9-506f-89d8-292de6ca828c","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"dsrzzi.jetgq.cn","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'dsrzzi.jetgq.cn']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--d7695193-008b-5d2c-a0a1-5d33f68909be","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"https://dsrzzi.jetgq.cn/jkautixtf/londut/","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://dsrzzi.jetgq.cn/jkautixtf/londut/']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--14646d38-f535-505d-9544-5d0ec6d3ce49","created":"2026-05-14T06:19:00.000Z","modified":"2026-05-14T06:19:00.000Z","valid_from":"2026-05-14T06:19:00.000Z","name":"165.154.231.146","description":"IOC reported by @Metemcyber on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '165.154.231.146']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Metemcyber/status/2054808764763734451"}],"labels":["phishing"]},{"type":"indicator","spec_version":"2.1","id":"indicator--a5c850a1-fcd9-5097-8622-b61d7d7d450c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--53dc60b1-b4d7-5274-a01f-ab1049a0487b","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"https://sufesuzu.z7.web.core.windows.net","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[url:value = 'https://sufesuzu.z7.web.core.windows.net']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--16422871-509b-5764-a4a7-f4193e37c81e","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"171.252.225.139","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '171.252.225.139']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--162040b9-a741-534c-af77-e7389df9757c","created":"2026-05-14T06:27:00.000Z","modified":"2026-05-14T06:27:00.000Z","valid_from":"2026-05-14T06:27:00.000Z","name":"20.60.131.1","description":"IOC reported by @Yurinoki_Yurin on Twitter/X.","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '20.60.131.1']","pattern_type":"stix","pattern_version":"2.1","created_by_ref":"identity--96b9f522-7592-502b-a5f7-8fa59a268afd","object_marking_refs":["marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"],"external_references":[{"source_name":"twitter","url":"https://x.com/Yurinoki_Yurin/status/2054810788477768053"}]}]}