[
 {
  "value": "166.88.134.62",
  "type": "ipv4",
  "first_seen": "2026-08-02",
  "last_seen": "2026-08-02",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for"
  ],
  "sources": [
   "https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique"
  ],
  "reason": "C2 endpoint in DPRK XCTDH HashHiding blockchain C2 network"
 },
 {
  "value": "16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8",
  "type": "sha256",
  "first_seen": "2025-10-20",
  "last_seen": "2025-10-20",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for"
  ],
  "sources": [
   "https://ransom-isac.org/blog/cross-chain-txdatahiding-crypto-heist/"
  ],
  "reason": "Malicious payload hash in DPRK XCTDH campaign (fake GitHub repo tailwind.config.js)"
 }
]