{ "type": "bundle", "id": "bundle--58d6580c-b038-558c-80a1-c4fa6b629cc9", "spec_version": "2.1", "objects": [ { "type": "campaign", "id": "campaign--674d7884-6e9a-524a-a999-4dcc5bc83042", "name": "AI evaluation sandbox escape", "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/anthropic-s-claude-models-breached-3-real-organizations-during-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1190", "T1078", "T1059", "T1041" ] }, { "type": "campaign", "id": "campaign--949a2a2a-9c55-5658-b966-f0336f003990", "name": "AI infrastructure targeting", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-target-litellm-ragflow-and-kestra-ai-infrastructure-to-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1190", "T1059", "T1552", "T1496", "T1041" ] }, { "type": "campaign", "id": "campaign--bb604bc6-c212-5e99-8865-64cab796729e", "name": "AI knowledge-distillation theft", "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "campaign", "id": "campaign--314bab4d-a19f-5037-9cfa-f9cec536e640", "name": "AI-Orchestrated PaperCut Exploitation", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/greynoise-agents-gone-wild-an-ai-orchestrated-global-campaign-ag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1078" ] }, { "type": "campaign", "id": "campaign--73b06b1a-adb6-5ecf-b446-15b289de17f6", "name": "AI-agent-assisted enterprise breach", "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-agents-breach-enterprise-network-in-under-10-hours-and-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1578" } ], "labels": [ "T1190", "T1003", "T1078", "T1578" ] }, { "type": "campaign", "id": "campaign--5768a160-064b-5c74-9446-cbd049449a00", "name": "AISURU", "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimwolf-botnet-rebuilt-to-survive-takedowns-researchers-say/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1568" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1498", "T1071", "T1568", "T1573", "T1036", "T1090" ] }, { "type": "campaign", "id": "campaign--af50eacd-3b0b-5d64-94d8-134f774c5718", "name": "APT28 HOOKEDGE European espionage", "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "campaign", "id": "campaign--c5c4f176-2477-583a-8e3e-ab85fe2a807b", "name": "ARTEX", "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/unknown-threat-actor-uses-ai-driven-artex-to-target-south-korean/" } ], "labels": [] }, { "type": "campaign", "id": "campaign--c6bf5869-7af0-5a9e-b67a-45d12021f363", "name": "ASCII smuggling phishing campaign", "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-ai-era-ascii-smuggling-to-hide-phishing-content-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1566", "T1027", "T1656" ] }, { "type": "campaign", "id": "campaign--4165f569-1719-5c77-9774-9dc4fc4c6ddd", "name": "ASEC July 2026 South Korea APT wave", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asec-july-2026-apt-attack-report-south-korea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1041" ] }, { "type": "campaign", "id": "campaign--4f2b3a2c-3488-5af7-bdb6-0980bca1e079", "name": "ATM jackpotting conspiracy", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "campaign", "id": "campaign--8b149e81-a365-5cf0-86b9-50a9b5040c89", "name": "Adception malvertising", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1583", "T1036", "T1674", "T1204" ] }, { "type": "campaign", "id": "campaign--f84c16a1-8dbc-561f-9de6-0de70d6a5711", "name": "AgentCorruption", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/agentcorruption-patched-aws-bedrock-agentcore-prompt-injection-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" } ], "labels": [ "T1674", "T1528", "T1565" ] }, { "type": "campaign", "id": "campaign--8be73fa9-a457-5ab9-a579-69424f5d0b54", "name": "AnonyMousKIT iPhone unlock phishing", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-anonymouskit-phaas-steals-apple-ids-and-2fa-codes-to/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" } ], "labels": [ "T1566", "T1621", "T1111", "T1539", "T1684" ] }, { "type": "campaign", "id": "campaign--cb98fa85-04cc-529b-a279-77aa1cc671ba", "name": "Anubis", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransom-busters-ransomware-affiliate-poses-as-recovery-firm-to-re/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1657", "T1565", "T1656" ] }, { "type": "campaign", "id": "campaign--fbfdd819-d4f5-54d6-9eba-221d064cb72c", "name": "Aurora affiliate multi-victim campaign", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/aurora-ransomware-affiliate-uses-cursor-ai-to-plan-attacks-again/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1558" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1021", "T1558", "T1071", "T1486" ] }, { "type": "campaign", "id": "campaign--8fd68b37-fbe1-5773-b652-ad1605ac0a38", "name": "BTR.sys weaponization / Living-off-the-Land driver abuse", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/microsoft-signed-defender-driver-weaponized-to-disable-edr-and-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1089" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1107" }, { "source_name": "MITRE ATT&CK", "external_id": "T1112" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1218" } ], "labels": [ "T1089", "T1562", "T1107", "T1112", "T1073", "T1218" ] }, { "type": "campaign", "id": "campaign--376b3fb9-3627-526c-b5ed-6810803c203c", "name": "BYOTC kernel driver abuse technique", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-attack-hijacks-trusted-security-apps-to-abuse-powerful-k/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" } ], "labels": [ "T1068", "T1055", "T1574" ] }, { "type": "campaign", "id": "campaign--b9372ebd-5d1f-5997-a178-9685f5d95cb6", "name": "BadBox automotive extension", "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-infect-android-car-head-units-with-proxy-botnet-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1505", "T1027", "T1041" ] }, { "type": "campaign", "id": "campaign--7fb21c9e-b3c5-52c0-8175-525ff2f97240", "name": "Balonx", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/balonx-phaas-steals-bank-otps-in-real-time-while-ai-calls-and-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1557", "T1539", "T1657" ] }, { "type": "campaign", "id": "campaign--0d0093f6-830c-5b24-8d70-bcc2be8cbda4", "name": "BigBear 2.0", "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-2-0-phishing-service-bypasses-mfa-in-global-m365-campaig/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1557", "T1539", "T1621", "T1071", "T1090" ] }, { "type": "campaign", "id": "campaign--923f3ba7-aa77-5b34-85c1-8b8d135a80a8", "name": "BigBear 2.0 M365 AiTM phishing", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organ/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" } ], "labels": [ "T1557", "T1539", "T1566", "T1111" ] }, { "type": "campaign", "id": "campaign--de077de2-1502-5aa2-b221-7a6ef1ac6b81", "name": "Blinder Tunnel", "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blinder-tunnel-campaign-targets-iraqi-infrastructure/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1059", "T1547", "T1105", "T1571", "T1090" ] }, { "type": "campaign", "id": "campaign--d5889426-edb0-5449-b78a-aa1b42e75bf2", "name": "BlueMoon exploitation campaign (Aug 2026+)", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "campaign", "id": "campaign--0ed3b915-09c4-5e1e-9685-ff415e27216c", "name": "BragJack", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bragjack-attacks-hijack-ai-browser-agents-through-malicious-exte/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1176", "T1059", "T1005", "T1113", "T1567" ] }, { "type": "campaign", "id": "campaign--50ec3d7d-05af-5806-a52a-92b122daad9b", "name": "Brevo CDN supply chain", "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/a-stolen-api-key-turned-brevo-s-cdn-into-a-supply-chain-weapon-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" } ], "labels": [ "T1195", "T1659", "T1078", "T1565" ] }, { "type": "campaign", "id": "campaign--bdda42d5-e919-5038-bf7a-5d35a8d27837", "name": "Brevo CDN supply chain", "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/incident-is-now-documented-https-sansec-io-research-brevo-supply/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1195", "T1659", "T1078" ] }, { "type": "campaign", "id": "campaign--9942a5d2-66e4-5050-b1d0-de2845ac6f0c", "name": "CARBONATO", "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-an-open-source-ai-agent-into-a-tool-for-controlling/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1046" }, { "source_name": "MITRE ATT&CK", "external_id": "T1611" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1543" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1190", "T1046", "T1611", "T1053", "T1543", "T1102" ] }, { "type": "campaign", "id": "campaign--18f0e5e1-2d9d-5c74-a28c-faa5dc96a701", "name": "CISA KEV October 2026 update", "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-adds-five-exploited-vulnerabilities-to-kev-catalog/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "campaign", "id": "campaign--eb323ad8-f8c1-5ce1-be5e-6c516ef3ad29", "name": "CISA KEV September 2026 update", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-adds-5-actively-exploited-flaws-to-its-kev-catalog-impactin/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" } ], "labels": [ "T1190", "T1068" ] }, { "type": "campaign", "id": "campaign--e23e4e23-65ce-5526-b9f8-02703b46d581", "name": "CVE-2026-0768 exploitation", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-start-exploiting-critical-langflow-vulnerability/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1552" ] }, { "type": "campaign", "id": "campaign--e724fa41-b432-5f63-b7a4-e652f9a350b6", "name": "CVE-2026-0768 exploitation", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/critical-ruby-on-rails-vulnerability-in-attackers-crosshairs/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1552" ] }, { "type": "campaign", "id": "campaign--1774af1b-162b-51c9-a084-ab95bb797850", "name": "CVE-2026-82329 exploitation", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/critical-jfrog-artifactory-vulnerability-reportedly-exploited-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1078" ] }, { "type": "campaign", "id": "campaign--87c0d126-e63b-553b-8c98-5638a873f1a5", "name": "CVE-2026-85102 Security Gateway VPN exploitation wave", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/check-point-warns-of-exploited-security-gateway-vpn-rce-cve-2026/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1649" }, { "source_name": "MITRE ATT&CK", "external_id": "T1046" } ], "labels": [ "T1190", "T1557", "T1649", "T1046" ] }, { "type": "campaign", "id": "campaign--60233838-d503-529a-8fbc-476bbf7691eb", "name": "CaptiveCrunch", "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1669", "T1659", "T1557", "T1621", "T1548", "T1185" ] }, { "type": "campaign", "id": "campaign--e8528d7e-550f-59ef-a2c5-c9dea1a6eef4", "name": "ChainDrop npm supply-chain worm", "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chaindrop-npm-worm-hijacks-github-actions-oidc-to-poison-444-pac/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1528" ] }, { "type": "campaign", "id": "campaign--3f73304a-1145-5800-a29e-e06458e986b7", "name": "ChatGPT shared links abuse", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1566", "T1059", "T1219" ] }, { "type": "campaign", "id": "campaign--1474b586-0281-5719-b641-c9052bdd247f", "name": "Check Point VPN exploitation campaign", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dutch-ncsc-warns-critical-check-point-vpn-rce-exploitation-is-im/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "campaign", "id": "campaign--68627487-722f-5ec3-9072-bcd89693ede4", "name": "Chinese AI model distillation", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "campaign", "id": "campaign--261b87c7-d423-552b-bd58-cc4399d89e7c", "name": "Cisco FMC exploitation campaign", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "campaign", "id": "campaign--c89555c9-db10-59b1-b115-c96c5ec8f44d", "name": "Cisco FMC exploitation campaign (Jul 2026+)", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "campaign", "id": "campaign--4af2d6ab-7e5a-5d21-82bf-07d599f0a7d6", "name": "Claude Code impersonation malvertising", "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/atomic-macos-amos-stealer-infection-campaign-observed/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1204", "T1036", "T1503" ] }, { "type": "campaign", "id": "campaign--8e115cd1-151f-57d6-a4da-d2398588247b", "name": "ClawHavoc", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/openclaw-novastealer-attacks-target-60-crypto-wallets-ssh-keys-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1566", "T1005", "T1555", "T1041" ] }, { "type": "campaign", "id": "campaign--08f25621-0a37-5188-b24a-1501fc2bbc7d", "name": "ClearFake", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wordlistloader-hides-shellcode-in-plain-english-words-to-deliver/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1204", "T1059", "T1027", "T1055" ] }, { "type": "campaign", "id": "campaign--52914df2-ba89-51ec-b978-6307939a8535", "name": "ClickFix", "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cybersecurity-ciberseguridad-ciberseguranca-security-seguridad-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1059", "T1105", "T1562" ] }, { "type": "campaign", "id": "campaign--58a1811a-db4b-571c-8510-7d7bacd7a08a", "name": "ClickFix", "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/phishing-campaign-abuses-windows-mshta-exe-to-steal-credentials/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1170" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1566", "T1170", "T1059", "T1555" ] }, { "type": "campaign", "id": "campaign--83b53701-1f62-5c36-8e15-86745c92bbf4", "name": "ClickFix", "spec_version": "2.1", "created": "2026-08-26T00:00:00Z", "modified": "2026-08-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/24-malicious-npm-packages-abuse-mirror-infrastructure-to-host-ob/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1195", "T1659", "T1566", "T1204" ] }, { "type": "campaign", "id": "campaign--e67ceb8f-d713-5540-bfc9-54db7350f5c2", "name": "ClickFix Google Sheets C2", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/clickfix-campaign-abuses-google-sheets-c2-to-inject-malicious-ja/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1102", "T1059" ] }, { "type": "campaign", "id": "campaign--d0edd1e1-8f72-5267-b779-a5fd6e87d74c", "name": "Clop Windchill mass exploitation", "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/clop-created-custom-web-shell-for-windchill-data-theft-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1212" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1081" } ], "labels": [ "T1190", "T1100", "T1212", "T1005", "T1041", "T1081" ] }, { "type": "campaign", "id": "campaign--4a8886ed-0846-57de-861f-167431cb5588", "name": "Coder registry supply-chain hijack", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-coder-module-registry-to-serve-malicious-pack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "campaign", "id": "campaign--12496cbe-db4d-5151-940d-683af6cd80d0", "name": "Contagious Interview", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "campaign", "id": "campaign--4fd4cffe-77ab-50fd-8da2-dc87d035629a", "name": "Contagious Interview", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-operators-move-beyond-git-hooks-with-trojan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1195", "T1204", "T1574", "T1547" ] }, { "type": "campaign", "id": "campaign--53bdd04d-ccaf-5656-a88a-801b913969d5", "name": "Contagious Interview", "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-north-korean-threat-actors-compromised-30-0/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1005" ] }, { "type": "campaign", "id": "campaign--b6599523-8c8f-5c36-86a1-59d79ecf249c", "name": "Contagious Interview", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "campaign", "id": "campaign--f5ebe483-cb5f-5a57-89ed-3db31d72d2c9", "name": "Contagious Interview", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "campaign", "id": "campaign--71a6ff79-bb79-5bc3-91f4-6221ea3768a3", "name": "Cross-Chain TxDataHiding (XCTDH)", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1566", "T1071", "T1105", "T1059" ] }, { "type": "campaign", "id": "campaign--0c7d5714-15c4-5640-bbfc-85b2bd666062", "name": "Cryptographic Context Injection", "spec_version": "2.1", "created": "2026-08-22T00:00:00Z", "modified": "2026-08-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/grok-zero-click-attack-steals-chat-history-through-encrypted-pro/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1059", "T1041" ] }, { "type": "campaign", "id": "campaign--3e2afcbf-6d14-581a-80f2-4a9a310c73a3", "name": "Custom GPT ClickFix", "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/threat-actors-abuse-chatgpt-custom-gpts-to-deliver-rat-payloads/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1060" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1204", "T1059", "T1086", "T1060", "T1053", "T1562" ] }, { "type": "campaign", "id": "campaign--8e3a2a67-fba0-5ac8-9de9-163831f5f66b", "name": "Custom GPT ClickFix", "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1060" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1204", "T1059", "T1086", "T1060", "T1053", "T1036" ] }, { "type": "campaign", "id": "campaign--9b3b4177-cf82-58fa-a6ab-917962048bb1", "name": "DAEMON Tools supply chain compromise", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/needymantis-unpacking-a-post-compromise-malware-family-used-in-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1570" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1195", "T1073", "T1570", "T1071" ] }, { "type": "campaign", "id": "campaign--a56ee622-e1c3-583d-b992-f276ef4869c9", "name": "DPRK HAProxy server espionage campaign", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-kor/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1195", "T1100", "T1005", "T1071", "T1562" ] }, { "type": "campaign", "id": "campaign--3a31d5bc-22fc-578e-b762-3bc7a934b8a3", "name": "Dark Caracal Latin America espionage", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dark-caracal-deploys-new-gocaracal-malware-with-ethereum-based-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1583", "T1105", "T1573", "T1005" ] }, { "type": "campaign", "id": "campaign--ad21d3f0-fd18-562c-b5e7-0cb4923b9237", "name": "DeadLock", "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1489", "T1548" ] }, { "type": "campaign", "id": "campaign--3a0f3ec1-e544-5d5f-b296-ba6163684923", "name": "DragonForce", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransom-busters-ransomware-affiliate-poses-as-recovery-firm-to-re/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1657", "T1565", "T1656" ] }, { "type": "campaign", "id": "campaign--6b542c35-b875-5fa9-b88a-c0295b58b0a9", "name": "ExploitGym agent coordination", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/700-openai-agents-coordinate-attack-on-hugging-face-and-gain-rem/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1059", "T1071", "T1105" ] }, { "type": "campaign", "id": "campaign--0b9edc6c-208c-5472-a955-2c05ddc38ba6", "name": "FBIJobs.gov breach", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-arrests-key-suspect-in-major-hack-of-agents-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" } ], "labels": [ "T1491" ] }, { "type": "campaign", "id": "campaign--2d6cbbfc-cc8c-5ca5-a74b-d2d7be400e53", "name": "Fake AI installer Vidar distribution", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-google-gemini-installer-distributes-vidar-stealer-via-googl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1503", "T1041" ] }, { "type": "campaign", "id": "campaign--55aac022-7a51-5875-81ec-73505db5c7dc", "name": "Fake Claude Opus 5", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-claude-opus-5-app-deploys-revstealer-to-steal-passwords-cry/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1036", "T1204", "T1539", "T1005" ] }, { "type": "campaign", "id": "campaign--9cac8c92-d4e3-5b89-9829-55d546c8cd3e", "name": "Fake LastPass GitHub repos", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infos/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1195", "T1574", "T1073", "T1562", "T1003" ] }, { "type": "campaign", "id": "campaign--1365cc9c-1e94-5aed-a654-22912d0db393", "name": "Fake VPN Chrome extension residential proxy network (31 extensions)", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-chrome-vpn-extensions-hijack-browser-traffic-through-russia/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" } ], "labels": [ "T1176", "T1090", "T1557" ] }, { "type": "campaign", "id": "campaign--15b94678-52bc-57d5-8411-5eadf747d21c", "name": "Fake recruiter campaign", "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/graphalgo-malware-hits-terraform-and-go-packages-in-new-supply-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1497", "T1102" ] }, { "type": "campaign", "id": "campaign--6e49ecfb-058c-5d2e-a6aa-60cf84d09f24", "name": "FakeAgent Claude desktop installer", "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "campaign", "id": "campaign--5131c82b-f965-5217-8376-ae9e9d95ef97", "name": "FakeGit", "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fakegit-campaign-7-600-malicious-github-repos-pushing-smartloade/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1608", "T1036", "T1204" ] }, { "type": "campaign", "id": "campaign--c5b4976f-3e3c-54b8-83ed-2a91799c3c92", "name": "FalconFlank", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/falconflank-poc-claims-crowdstrike-falcon-zero-day-enables-privi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1068", "T1548" ] }, { "type": "campaign", "id": "campaign--b3c50950-4bc6-514f-bdcc-58d3d52f0b41", "name": "Florida DAVID database breach", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/florida-confirms-dmv-database-breached-via-stolen-police-account/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1078", "T1110", "T1005" ] }, { "type": "campaign", "id": "campaign--1f0b6e4b-6777-56b9-8bb3-bb856b00d204", "name": "FortiBleed", "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fortibleed-attackers-locking-victims-out-of-fortinet-devices/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1531" } ], "labels": [ "T1190", "T1133", "T1110", "T1078", "T1098", "T1531" ] }, { "type": "campaign", "id": "campaign--e674815e-cfe9-5405-910a-d7731e3ff117", "name": "FortiBleed", "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1040" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" } ], "labels": [ "T1190", "T1110", "T1078", "T1040", "T1098", "T1070" ] }, { "type": "campaign", "id": "campaign--ef90b095-4d29-5cc7-9cda-3161f061b9a2", "name": "GhostAction", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-campaign-that-never-stopped-tracking-ghostaction-from-2025-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1528", "T1567" ] }, { "type": "campaign", "id": "campaign--0d813d6c-506c-5680-bb87-f70c8ea33232", "name": "Google infrastructure phishing campaign", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/global-phishing-campaign-abuses-google-infrastructure-to-evade-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1102", "T1071" ] }, { "type": "campaign", "id": "campaign--8e9c4395-768f-54b4-81b6-8a83f3618d83", "name": "HOOKEDGE European diplomatic espionage", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "campaign", "id": "campaign--e746f5ba-1555-5a59-ae24-07c6df23170b", "name": "Hafnium", "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/u-s-offers-10-million-reward-for-chinese-hacker-behind-alleged-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "campaign", "id": "campaign--6f2ed230-0489-567f-a77c-7cbf36d50541", "name": "HashHiding", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1566", "T1071", "T1105", "T1059" ] }, { "type": "campaign", "id": "campaign--ca7ef143-c946-51cd-9a50-33873cbfea81", "name": "Head Mare TrueConf supply chain attack", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/trueconf-security-advisory-av26-835/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1190", "T1204", "T1059" ] }, { "type": "campaign", "id": "campaign--1bca6115-a502-5808-a1eb-1d432cc3522d", "name": "HexMage", "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/magecart-hackers-abuse-ethereum-smart-contracts-to-steal-card-da/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1189", "T1056", "T1567" ] }, { "type": "campaign", "id": "campaign--2ccc6c77-adfe-5659-9bfd-d00284ab3f22", "name": "HoneyMyte espionage campaign", "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kern/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1014", "T1055", "T1140", "T1027" ] }, { "type": "campaign", "id": "campaign--633660a8-0ead-54e0-97f2-a63c0164b1eb", "name": "Infected Marketplace", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-brazetsu-malware-turns-compromised-corporate-pcs-into/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1059", "T1539", "T1005", "T1082" ] }, { "type": "campaign", "id": "campaign--e7aacb01-595c-52b4-a89d-ccf39126efa9", "name": "InjectEave electromagnetic side-channel research", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/injecteave-attack-lets-attackers-eavesdrop-on-headphone-audio-fr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" } ], "labels": [ "T1203" ] }, { "type": "campaign", "id": "campaign--e24f95f1-c09f-539f-9ebe-c61fcbdc948d", "name": "Inter-gang rivalry", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-breaches-clop-leak-site-and-steals-onion-service-ke/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1505", "T1552" ] }, { "type": "campaign", "id": "campaign--52132044-37d0-5ad7-bbc0-1cfbeffbc44e", "name": "JOMANGY", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1190", "T1100", "T1053", "T1037", "T1562" ] }, { "type": "campaign", "id": "campaign--56c9f897-6dbd-529d-8a95-0a162fc104e7", "name": "JWR banking fraud campaign", "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/jwr-phishing-as-a-service-kit-uses-websockets-and-aes-to-run-rea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1557", "T1056", "T1071" ] }, { "type": "campaign", "id": "campaign--0bfdb565-854e-5afb-9cd6-10b224f7de3f", "name": "KREMLIN banking campaign", "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credent/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1176", "T1557", "T1539", "T1555" ] }, { "type": "campaign", "id": "campaign--72893383-43e0-56fd-b7b5-dbfff4fd251a", "name": "KelpDAO-LayerZero compromise", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "campaign", "id": "campaign--f7f2fb72-cb74-5a93-bb97-1fd8f86e814b", "name": "KindaRails2Shell", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ruby-on-rails-active-storage-flaw-cve-2026-66066-cvss-9-5-unauth/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1005", "T1552" ] }, { "type": "campaign", "id": "campaign--f48972bd-c820-577f-bcba-a7d23b59e202", "name": "LLMjacking", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/llmjacking-attack-abuses-leaked-aws-credentials-to-hijack-amazon/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1648" } ], "labels": [ "T1078", "T1552", "T1648" ] }, { "type": "campaign", "id": "campaign--663829ba-a6a6-5237-bb94-ad7aae4fc36e", "name": "Latin American government espionage", "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-famoussparrow-is-targeting-government-organizations/" } ], "labels": [] }, { "type": "campaign", "id": "campaign--e98161af-ee5d-50e7-a07c-51baa34c5472", "name": "Latin American government espionage", "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1190", "T1100", "T1059", "T1113" ] }, { "type": "campaign", "id": "campaign--a0133d55-ade5-57bb-8690-92b811c6c10a", "name": "Lunex fake-CAPTCHA ClickFix campaign", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/psychedelic-stealer-spread-via-fake-captcha-prompts-on-ukrainian/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1659", "T1204", "T1059", "T1548", "T1014", "T1053" ] }, { "type": "campaign", "id": "campaign--a5cab645-4989-577c-88f5-71ff90a5ea1e", "name": "MALFEX", "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/long-running-npm-malware-campaign-accumulates-40-000-downloads/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1204", "T1059" ] }, { "type": "campaign", "id": "campaign--d0dd87c9-96ba-5569-9a97-6fe440f9fb65", "name": "MALFEX", "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malfex-eight-malicious-npm-packages-deliver-overlord-rat-40-767/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1204", "T1059" ] }, { "type": "campaign", "id": "campaign--1d2fff36-03b6-5a3c-8b6a-58c15c197127", "name": "MALFEX supply chain campaign", "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malfex-supply-chain-campaign-targets-npm-and-github/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1195", "T1059", "T1503" ] }, { "type": "campaign", "id": "campaign--c33ff2f1-74eb-569e-95f6-fb15eec1c759", "name": "MacSync malvertising/ClickFix campaign", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1204", "T1059", "T1555" ] }, { "type": "campaign", "id": "campaign--5a474ea7-1f8b-53e8-b21b-4755ac86c5a6", "name": "Manic Android banking malware campaign", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/manic-android-malware-family-targets-169-apps-with-banking-fraud/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1674", "T1056", "T1669", "T1005", "T1567" ] }, { "type": "campaign", "id": "campaign--68aea0e9-9096-55a8-a375-2ee1d8050fcd", "name": "Mantax OTAX double-extortion campaign", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mantax-otax-combines-android-ransomware-and-spyware-for-double-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1204", "T1059", "T1486" ] }, { "type": "campaign", "id": "campaign--e4a40e7d-893c-51da-80fa-f34172cbcafc", "name": "Metabase zero-day exploitation", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mathspace-discloses-data-breach-affecting-over-1-million-people/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "campaign", "id": "campaign--655c4e1b-2b7e-5b42-947b-4931b3f25ee1", "name": "Midnight Mimosa", "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1019" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1019", "T1105", "T1071", "T1090", "T1036", "T1496" ] }, { "type": "campaign", "id": "campaign--b7c85763-99b2-581a-9930-24b3581a1700", "name": "Midnight Mimosa", "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/midnight-mimosa-preinstalled-android-malware-in-mediatek-firmwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1019" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1019", "T1071", "T1496", "T1036" ] }, { "type": "campaign", "id": "campaign--be4b36fa-94fd-5d44-a26b-618924cc36c4", "name": "MikroTrick", "spec_version": "2.1", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-actively-exploiting-mikrotik-routeros-mikrotrick-flaws-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1078" ] }, { "type": "campaign", "id": "campaign--cce5503d-89b9-5ce7-aad2-a2dc35357d74", "name": "MikroTrick", "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/al26-020-vulnerabilities-impacting-mikrotik-routeros-cve-2026-67/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" } ], "labels": [ "T1190", "T1068" ] }, { "type": "campaign", "id": "campaign--7f4158d8-ae48-5ee5-989b-7129f297c7b1", "name": "Nexus dark web marketplace", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-probes-service-selling-153m-drivers-licenses/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" }, { "source_name": "MITRE ATT&CK", "external_id": "T1597" } ], "labels": [ "T1589", "T1597" ] }, { "type": "campaign", "id": "campaign--2763b912-13fe-5f26-9af9-66c9e47d7ddf", "name": "NightmareStresser DDoS-for-hire", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-and-rcmp-have-seized-domains-linked-to-nightmarestresser-a-d/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" }, { "source_name": "MITRE ATT&CK", "external_id": "T1499" } ], "labels": [ "T1498", "T1499" ] }, { "type": "campaign", "id": "campaign--9ca3da42-1e70-52ad-ad03-373bf30f3192", "name": "Open VSX evil-twin supply-chain", "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/77-evil-twin-open-vsx-extensions-harvest-developer-metadata-shar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1592" }, { "source_name": "MITRE ATT&CK", "external_id": "T1590" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1592", "T1590", "T1567", "T1041" ] }, { "type": "campaign", "id": "campaign--b12dc92e-3205-52e5-bcfd-4a7efe709d82", "name": "Operation APT35", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-charges-17-iranian-hackers-offers-10m-rewards-for-5-of-them/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1078" ] }, { "type": "campaign", "id": "campaign--54d2d559-5e5e-5e5c-a917-deb7a781db36", "name": "Operation ASTERIX", "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/operation-asterix-uses-vishing-and-fake-crypto-wallet-apps-to-st/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1598", "T1566", "T1056", "T1102" ] }, { "type": "campaign", "id": "campaign--a42909ef-95d6-536f-b1f6-5fa3ab24fc56", "name": "Operation CameraSwarm", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1190", "T1133", "T1505", "T1078" ] }, { "type": "campaign", "id": "campaign--df44829c-a82f-54d5-a17e-9740bb371f01", "name": "Operation Conflict Compass", "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/konni-hackers-target-ukraine-with-malicious-lnk-files-and-velvet/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" } ], "labels": [ "T1193", "T1204", "T1053", "T1086", "T1608" ] }, { "type": "campaign", "id": "campaign--86cc05f4-072f-5518-b3a5-fe81b22e8f71", "name": "Operation Dream Job", "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "campaign", "id": "campaign--7fbd8aa7-e00c-542f-b9e2-f645bfc8f006", "name": "Operation GitPower", "spec_version": "2.1", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimsuky-uses-the-ai-agent-opencode-to-create-decoys-as-its-githu/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1193", "T1059", "T1027" ] }, { "type": "campaign", "id": "campaign--d67a3980-c1d3-5ef9-b897-160c96db6a98", "name": "Operation GitPower", "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimsuky-moves-ai-assisted-development-into-local-environment-wit/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1102" ] }, { "type": "campaign", "id": "campaign--74f133ef-adce-5d2f-b1c5-d21b37f7dd57", "name": "Operation Jackal IV", "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/police-arrests-dozens-of-suspects-in-global-cybercrime-crackdown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1657" ] }, { "type": "campaign", "id": "campaign--642198e9-d9d3-5a14-861c-044474933b86", "name": "Operation QUICSILVER", "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1204", "T1059", "T1573" ] }, { "type": "campaign", "id": "campaign--0417dca9-6c82-54ad-96f2-1f7407a3a0e8", "name": "OphimCMS/KKPhim supply chain", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/packagist-themes-exploit-iphone-visitors-to-steal-messages-passw/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1195", "T1189", "T1659", "T1539", "T1005" ] }, { "type": "campaign", "id": "campaign--f4394724-a1ac-5bf2-96eb-9121a3f768a6", "name": "Oracle EBS extortion campaign", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bimbo-bakeries-usa-data-breach-exposes-ssns-in-oracle-e-business/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1005", "T1567" ] }, { "type": "campaign", "id": "campaign--2e8d523b-ef03-516e-80c7-ed3d22b6116d", "name": "PamStealer Wavel variant", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-pamstealer-macos-variant-adds-live-c2-payload-decryption-and/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" }, { "source_name": "MITRE ATT&CK", "external_id": "T1159" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1059", "T1037", "T1159", "T1573", "T1105" ] }, { "type": "campaign", "id": "campaign--a3b3f14a-c671-5923-970a-dc500afff184", "name": "Panzer RaaS launch", "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-hits-16-victims-across-11-countries-with-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1567" ] }, { "type": "campaign", "id": "campaign--8faddccd-aee4-5181-8334-0a800a75ae36", "name": "Panzer RaaS launch campaign", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-emerges-with-windows-linux-esxi-and-freebsd-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "campaign", "id": "campaign--aa17336a-3712-599c-9eb1-d74f1ddbc569", "name": "PaperCut exploitation campaign", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/papercut-flaws-exploited-in-ai-powered-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1059" ] }, { "type": "campaign", "id": "campaign--27092096-35f5-5f93-b2f9-6ef18ba9ec4e", "name": "PaperCut mass exploitation", "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-deploy-hundreds-of-ai-agents-to-exploit-papercut-flaws-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1087" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" } ], "labels": [ "T1190", "T1059", "T1021", "T1078", "T1087", "T1136" ] }, { "type": "campaign", "id": "campaign--68f4d260-4c83-5001-8376-b0c3b95a246e", "name": "PaperCut zero-day exploitation", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "campaign", "id": "campaign--76ee1ecb-babc-5ae2-8830-edee8a0a1b3b", "name": "Passkey enrollment social engineering campaign", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/microsoft-attackers-are-social-engineering-help-desks-into-enrol/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1566", "T1098", "T1656" ] }, { "type": "campaign", "id": "campaign--198a8ab1-eee0-5f39-a91e-f0e14694230a", "name": "Peer2Profit/AstroProxy residential proxy abuse", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/peer2profit-astroproxy-residential-proxy-network-exposes-interna/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1584" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1583", "T1584", "T1090" ] }, { "type": "campaign", "id": "campaign--5082e950-3e9e-5464-bc9d-488ef3bc5fad", "name": "PeopleSoft mass exploitation", "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/accenture-contractor-removed-after-fbi-data-breach-exposes-thous/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1048" } ], "labels": [ "T1190", "T1560", "T1048" ] }, { "type": "campaign", "id": "campaign--ca225919-24ad-52d1-9d76-a5331f680fd1", "name": "Phantom Deal", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-pose-as-executives-and-use-fake-ndas-to-steal-corporate/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1534" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1534", "T1657" ] }, { "type": "campaign", "id": "campaign--8cde1aec-0027-5479-8fd5-947a2adc440a", "name": "Philippine nuclear/naval espionage", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-speaking-hackers-exploit-known-flaws-to-steal-philippine/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1190", "T1210", "T1005", "T1041" ] }, { "type": "campaign", "id": "campaign--1db43642-7961-5b0f-9b2b-165311d16d3e", "name": "Plump Spider", "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-breach-brazilian-financial-firms-and-execute-hundreds-of/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1566", "T1078" ] }, { "type": "campaign", "id": "campaign--01ab67d9-abcc-5f7f-94a4-7a6e5dda3de9", "name": "PoisonedRefresh", "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/f5-big-ip-apm-malware-injects-a-php-web-shell-into-memory-evadin/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1100", "T1059", "T1055", "T1562" ] }, { "type": "campaign", "id": "campaign--6966e8fc-70e1-5829-a8bf-9bf883b60fd2", "name": "PrettyPrague", "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/prettyprague-poc-claims-avast-antivirus-zero-day-enables-system/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1068", "T1003" ] }, { "type": "campaign", "id": "campaign--66beb626-205f-53ee-beed-fd486c3ad0ec", "name": "Qilin August 2026 victim wave", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/qilin-targets-canadian-firm-b-wright-drywall-in-ransomware-attac/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "campaign", "id": "campaign--7e27e4ca-1c2e-53b0-84cf-a88f0ff78e59", "name": "Qilin ransomware campaign", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/atf-investigating-major-cyber-incident-after-ransomware-group-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1490", "T1567" ] }, { "type": "campaign", "id": "campaign--741c19fd-0953-5ee8-b94e-ad471a2b9eea", "name": "RAVEN Elasticsearch exploitation campaign", "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/raven-tool-steals-entire-elasticsearch-databases-and-rebuilds-de/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1213" }, { "source_name": "MITRE ATT&CK", "external_id": "T1020" }, { "source_name": "MITRE ATT&CK", "external_id": "T1030" } ], "labels": [ "T1595", "T1190", "T1078", "T1505", "T1213", "T1020", "T1030" ] }, { "type": "campaign", "id": "campaign--e679c300-36ab-5e32-b8aa-7b0f442a609f", "name": "RatHat smishing campaign", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/rathat-lets-an-ai-assistant-read-your-phone-s-screen-and-tap-thr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1189", "T1059", "T1056", "T1111", "T1674", "T1071" ] }, { "type": "campaign", "id": "campaign--4a22f08f-2c05-5e84-8426-65eb35809bf8", "name": "RedFlick", "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105" ] }, { "type": "campaign", "id": "campaign--e7785b0a-36ba-539f-ba90-d2f2365110eb", "name": "RedFlick", "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/star-blizzard-refines-phishing-and-malware-delivery-with-the-red/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1204", "T1053" ] }, { "type": "campaign", "id": "campaign--13add0fd-6bfb-552b-b365-83f4db7d732d", "name": "RemControl fake Play Store banking trojan campaign", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/remcontrol-android-malware-targets-european-and-canadian-users-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1015" } ], "labels": [ "T1583", "T1684", "T1015" ] }, { "type": "campaign", "id": "campaign--804e6252-a121-54b5-a9f5-516f3a5d6821", "name": "Revolut customer data theft", "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1566", "T1656", "T1005", "T1567" ] }, { "type": "campaign", "id": "campaign--5354baa8-5732-5f15-a9be-7a408247e956", "name": "Revolut government impersonation social engineering", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/revolut-discloses-data-breach-exposing-financial-info-passports/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1672" } ], "labels": [ "T1566", "T1656", "T1672" ] }, { "type": "campaign", "id": "campaign--f743dcee-874f-57f8-8908-72ede0637659", "name": "Russian social-engineering credential theft campaign", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "campaign", "id": "campaign--a3658575-4f9d-5bcf-8106-b39d162b1a02", "name": "Rust crate supply chain compromise (onering, arrayref, append-only-vec, internment)", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/compromised-rust-crate-with-18-000-downloads-steals-source-code/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1027", "T1041" ] }, { "type": "campaign", "id": "campaign--22fe5244-9e84-5c10-9880-380d7f7d551f", "name": "SETTRA ransomware", "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/settra-ransomware-uses-meshagent-rmm-and-byovd-to-encrypt-window/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1219", "T1562", "T1059", "T1486" ] }, { "type": "campaign", "id": "campaign--98081f7e-787e-508b-a05b-1feebf5f25a1", "name": "SHADOW-AETHER-064", "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-breach-brazilian-financial-firms-and-execute-hundreds-of/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1566", "T1078" ] }, { "type": "campaign", "id": "campaign--498e3e8e-4e92-5bfc-afac-cbea84528952", "name": "Salesloft Drift token campaign", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigati/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1190", "T1491", "T1656", "T1657" ] }, { "type": "campaign", "id": "campaign--efb0182f-6495-5cab-bc08-04ba397fabb2", "name": "Sality P2P botnet", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1583", "T1071", "T1486" ] }, { "type": "campaign", "id": "campaign--b1fcff31-a8fa-51f4-83dc-583b357470b8", "name": "Settra", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransom-busters-ransomware-affiliate-poses-as-recovery-firm-to-re/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1657", "T1565", "T1656" ] }, { "type": "campaign", "id": "campaign--fccda6d5-1b84-5b75-a432-8f47df8cb9c8", "name": "ShadowPanel", "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cyberpanel-pre-auth-rce-flaws-let-attackers-gain-remote-server-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1190", "T1059", "T1053" ] }, { "type": "campaign", "id": "campaign--6f1c6c0a-f7fd-574e-b357-873b29d42adc", "name": "Shai-Hulud npm supply-chain worm reactivation", "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/npm-supply-chain-worm-returns-after-four-month-dormancy-with-sam/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "campaign", "id": "campaign--f5e4f5f6-5ef5-5cb7-8747-4015a4012514", "name": "Shai-Hulud supply chain campaign", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mini-shai-hulud-worm-re-infects-github-repositories-via-hijacked/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1195", "T1677", "T1528", "T1041", "T1485" ] }, { "type": "campaign", "id": "campaign--cedc8e51-b2f0-53ce-b9dd-fc734ebda063", "name": "Shai-Hulud supply chain worm", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/two-alleged-teampcp-hackers-arrested-in-australia/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1078", "T1005", "T1041" ] }, { "type": "campaign", "id": "campaign--6d4e608c-e63a-52be-b719-241eb4f08702", "name": "ShinyHunters PeopleSoft campaign (CVE-2026-35273)", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigati/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1190", "T1491", "T1656", "T1657" ] }, { "type": "campaign", "id": "campaign--fd9a8364-3cd7-54c7-9168-3f8a99b3fd40", "name": "ShinyHunters PeopleSoft exploitation", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/oracle-peoplesoft-cve-2026-35273-cvss-9-8-mitigations-released-m/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1048" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1505", "T1059", "T1048", "T1078" ] }, { "type": "campaign", "id": "campaign--10561949-fa4c-56da-8f0d-990d1cd86a44", "name": "ShinyHunters PeopleSoft exploitation campaign", "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-have-apparently-breached-fbi-systems-and-have-extracted/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1491", "T1005", "T1567", "T1219" ] }, { "type": "campaign", "id": "campaign--dd35a9e0-1bf6-5b04-ab6a-50d493bf732b", "name": "ShinyHunters extortion campaign", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-claims-284m-patient-records-from-mckesson-breach/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1078", "T1567" ] }, { "type": "campaign", "id": "campaign--b394727d-828b-55c3-8034-af4c9e50bb75", "name": "SilkParasite Central Asian government espionage", "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "campaign", "id": "campaign--a13907a6-6e83-58c6-b88d-13a50d8edaa8", "name": "Silver Fox counterfeit installer campaign", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/silver-fox-hackers-target-china-based-organizations-with-counter/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1564" } ], "labels": [ "T1036", "T1204", "T1059", "T1564" ] }, { "type": "campaign", "id": "campaign--2f2bdc72-e6f3-5f81-9bc8-3778ed27a878", "name": "SilverFox fake software download portal campaign", "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/silverfox-malware-campaign-uses-smart-filtering-to-hide-fake-sof/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1194" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1194", "T1073", "T1116", "T1036" ] }, { "type": "campaign", "id": "campaign--842c3d25-09ea-5b24-8f5b-aa07ff436a2c", "name": "SloppyRAT ClickFix delivery campaign", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sloppyrat-malware-uses-clickfix-and-blockchain-c2-to-help-ransom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1204", "T1059", "T1021", "T1071" ] }, { "type": "campaign", "id": "campaign--d5e64f1b-ebb6-568d-bd2e-b59afeecdfc5", "name": "Sogou Input Method CVE-2026-51990 exploitation campaign", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1190", "T1059", "T1203", "T1038", "T1573" ] }, { "type": "campaign", "id": "campaign--4162e753-20b8-5dc0-96b7-24bd2d05dbc7", "name": "Spring Ring", "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-pose-as-it-support-on-microsoft-teams-to-target-more-tha/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" } ], "labels": [ "T1566", "T1684", "T1219", "T1557" ] }, { "type": "campaign", "id": "campaign--96b37127-f567-57ce-b13c-cc2b3573a181", "name": "Steamtv Esp.", "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/streamrat-android-malware-abuses-accessibility-and-vnc-to-take-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1015" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1566", "T1015", "T1056", "T1113" ] }, { "type": "campaign", "id": "campaign--bc9fd4ad-0319-5c0d-9e1d-2a463a85ddde", "name": "StopAndProtect WordPress campaign", "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stop/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1505", "T1567" ] }, { "type": "campaign", "id": "campaign--cb334af9-d839-5af6-843c-c5b54fac76cd", "name": "Storm financial services targeting campaign", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-ransomware-strikes-gsac-auto-financing/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" } ], "labels": [ "T1486", "T1199" ] }, { "type": "campaign", "id": "campaign--3ae02025-2861-5f20-be33-36e5a8d8351e", "name": "StyleSmuggler", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/adobe-releases-september-2026-patches-for-multiple-products-adob/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" } ], "labels": [ "T1190", "T1505", "T1100" ] }, { "type": "campaign", "id": "campaign--d4c02999-5478-56c8-963a-9c7d8d971768", "name": "StyleSmuggler", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/adobe-security-advisory-av26-888/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" } ], "labels": [ "T1190", "T1100" ] }, { "type": "campaign", "id": "campaign--e6cbb8a7-c6b7-5ec2-a89f-6812880362c1", "name": "StyleSmuggler", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/stylesmuggler-a-magento-zero-day-cve-2026-75650-delivering-a-rus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1190", "T1505", "T1100", "T1105" ] }, { "type": "campaign", "id": "campaign--b02dff39-fc53-5bda-a360-2313ea1c81fa", "name": "Superior", "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malicious-chrome-and-edge-extensions-hijack-crypto-wallets-and-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1176", "T1539", "T1071", "T1056", "T1005" ] }, { "type": "campaign", "id": "campaign--775136a0-eb3e-568e-bf94-44c5ce86b5c9", "name": "TA419 AI policy credential phishing", "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-ta419-hackers-target-us-ai-policy-experts-with-cred/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1556" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1557", "T1556", "T1539" ] }, { "type": "campaign", "id": "campaign--e0c23140-5d16-5b9c-b2ed-27c2c1f7ba41", "name": "TITAN RaaS", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/titan-raas-uses-ai-for-data-classification-regulatory-analysis-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1567" ] }, { "type": "campaign", "id": "campaign--90475049-79dc-5c65-8728-73259149a481", "name": "TanStack Query supply-chain compromise", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-tanstack-query-npm-package-to-steal-developer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "campaign", "id": "campaign--8b35bca2-6764-5165-9f60-6f8fde6b0323", "name": "TanStack npm supply-chain attack", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-git/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1552", "T1567" ] }, { "type": "campaign", "id": "campaign--c717b759-9dbc-5cfb-9755-cf9405209f57", "name": "Tax-themed phishing campaign", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-deploy-packclient-rat-via-tax-themed-phishing-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1059", "T1204", "T1053" ] }, { "type": "campaign", "id": "campaign--f99f006f-dcba-5461-8417-75863173416c", "name": "Teams IT help desk impersonation", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/microsoft-teams-help-desk-impersonation-when-it-support-messages/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1534" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1566", "T1534", "T1656", "T1219" ] }, { "type": "campaign", "id": "campaign--8a139716-f133-569b-bb9b-e35465809e41", "name": "TerminalFix campaign", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-use-fake-cloudflare-captcha-to-deploy-terminalfix-revers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1059", "T1204", "T1574", "T1027", "T1105" ] }, { "type": "campaign", "id": "campaign--48f968a0-3314-5efb-b599-14d34a0af473", "name": "ToolShell", "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-exploits-sharepoint-vulnerabilities-targeting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1486" ] }, { "type": "campaign", "id": "campaign--8a50b109-a3d7-52c9-a209-1f380ffd2cf0", "name": "Totolink A3002MU mass exploitation", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cve-2026-90607-critical-9-9-a-vulnerability-was-detected-in-toto/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "campaign", "id": "campaign--d1937002-0c8b-5971-a375-f8ea49ae2b18", "name": "Totolink A3002MU mass exploitation", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cve-2026-90606-critical-buffer-overflow-in-totolink-a3002mu-hh-b/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" } ], "labels": [ "T1190", "T1195" ] }, { "type": "campaign", "id": "campaign--31850039-42cb-584f-a8d1-8f0b5325f324", "name": "Toy Ghouls custom malware campaign", "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "campaign", "id": "campaign--5554f613-537a-51ca-bc3c-cabb01f9946e", "name": "Trinitite", "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shai-hulud-trinitite-supply-chain-worm-hits-npm-package-with-150/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" } ], "labels": [ "T1195", "T1552", "T1677" ] }, { "type": "campaign", "id": "campaign--96345ca5-8252-5319-b5e4-259bd3366d06", "name": "UAC-0145 fake interview", "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "campaign", "id": "campaign--6779d38a-8c0f-5194-aa7b-5340dcf03adf", "name": "UAC-0277 ClickFix campaign", "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cert-ua-100-websites-compromised-to-spread-lunex-stealer-via-fak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1189", "T1674", "T1059", "T1555", "T1539" ] }, { "type": "campaign", "id": "campaign--9d367d28-f18c-5b1c-be52-78b4aaeda58c", "name": "UNC6293 OAuth phishing", "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "campaign", "id": "campaign--5f227cc5-1209-5550-af3e-6c470171d515", "name": "UNK_CondorFiltration", "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/teamfiltration-hackers-target-5-700-microsoft-365-accounts-to-ex/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1078" ] }, { "type": "campaign", "id": "campaign--c5c03068-ab7c-58c3-ac01-2bd545e286a7", "name": "WatchFirebox exploitation for ransomware initial access", "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks-htt/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1059" ] }, { "type": "campaign", "id": "campaign--3caa6c66-70e2-5269-9abb-df042447f0f4", "name": "WatchGuard Firebox ransomware exploitation", "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-confirms-watchguard-firebox-rce-cve-2025-14733-is-being-exp/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1486" ] }, { "type": "campaign", "id": "campaign--78894a17-8b71-5f4e-99f2-181b3604535b", "name": "WaterPlum fake recruitment", "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "campaign", "id": "campaign--7ea3d2c6-b061-5aad-bc93-cf4209ce5ecb", "name": "WeWorm WeChat zero-click worm", "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wechat-zero-click-worm-took-over-accounts-on-iphone-and-android/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1091" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" } ], "labels": [ "T1189", "T1091", "T1098" ] }, { "type": "campaign", "id": "campaign--1a0def59-070b-59b5-bc6c-62e3c989396b", "name": "cPanel exploitation campaign feeding botnet activity", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cpanel-whm-critical-authentication-bypass-cve-2026-41940-cvss-9/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" } ], "labels": [ "T1190", "T1078", "T1110" ] }, { "type": "campaign", "id": "campaign--60291b5f-a351-5c05-8e19-d6125447d997", "name": "llms.txt supply-chain attack vector", "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/researchers-execute-code-inside-fortune-500-companies-via-ai-age/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1195", "T1059", "T1105" ] }, { "type": "campaign", "id": "campaign--8bc9fe4e-be66-5b60-864e-29a153649bc3", "name": "npm runtime supply-chain malware", "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/npm-supply-chain-malware-is-moving-beyond-install-scripts-the-ma/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1059", "T1102" ] }, { "type": "campaign", "id": "campaign--9d1c0d62-716a-5e39-8092-f41237ece9ab", "name": "vCenter exploitation campaign", "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-chinese-hackers-turn-vmware-vcenter-rce-into-root-back/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1053", "T1078", "T1486" ] }, { "type": "identity", "spec_version": "2.1", "id": "identity--db4903be-030f-511a-9d03-b123ea180d31", "name": "Tia N. List", "identity_class": "organization", "created": "2026-10-14T00:00:00Z", "modified": "2026-10-14T00:00:00Z", "description": "Daily threat intelligence and detection content from Tia N. List coverage." }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fb8faf9e-2398-5e86-9b96-3bbdf72b0b3c", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "103.102.31.18 (ipv4)", "pattern": "[ipv4-addr:value = '103.102.31.18']", "valid_from": "2026-09-05T00:00:00Z", "valid_until": "2026-10-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "active", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=103.102.31.18" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--733fcdc5-7610-5cc6-83aa-44fa6bc4db11", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "103.236.84.103 (ipv4)", "pattern": "[ipv4-addr:value = '103.236.84.103']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=103.236.84.103" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9b5cef09-5eb1-5037-a326-6d4701825b63", "created": "2026-05-30T00:00:00Z", "modified": "2026-05-30T00:00:00Z", "name": "104.207.144.154 (ipv4)", "pattern": "[ipv4-addr:value = '104.207.144.154']", "valid_from": "2026-05-30T00:00:00Z", "valid_until": "2026-05-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=104.207.144.154" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--da49c455-d8d8-510a-8d9b-6df46312cfe5", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "name": "111.228.49.20 (ipv4)", "pattern": "[ipv4-addr:value = '111.228.49.20']", "valid_from": "2026-09-12T00:00:00Z", "valid_until": "2026-09-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=111.228.49.20" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a504796e-a94b-504d-b7bd-86b45eff6725", "created": "2024-02-19T00:00:00Z", "modified": "2024-02-19T00:00:00Z", "name": "118.69.65.60 (ipv4)", "pattern": "[ipv4-addr:value = '118.69.65.60']", "valid_from": "2024-02-19T00:00:00Z", "valid_until": "2024-02-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=118.69.65.60" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a46b2352-62aa-5e15-883e-e1d63a05f76f", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "name": "120.53.19.157 (ipv4)", "pattern": "[ipv4-addr:value = '120.53.19.157']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-10-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=120.53.19.157" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0bea8c3e-d57d-59e7-80e4-c72e3e24b49d", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "name": "13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 (sha256)", "pattern": "[file:hashes.SHA-256 = '13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-09-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed1c8784-1948-59e7-bcfc-c0beab48ca1c", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "135.136.63.63 (ipv4)", "pattern": "[ipv4-addr:value = '135.136.63.63']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=135.136.63.63" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4c594409-317a-575b-820d-77638a7bbb44", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "138.2.102.66 (ipv4)", "pattern": "[ipv4-addr:value = '138.2.102.66']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=138.2.102.66" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b7cdae81-aa27-5a00-b787-76fc75c2daff", "created": "2026-06-22T00:00:00Z", "modified": "2026-06-22T00:00:00Z", "name": "138.226.246.94 (ipv4)", "pattern": "[ipv4-addr:value = '138.226.246.94']", "valid_from": "2026-06-22T00:00:00Z", "valid_until": "2026-06-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=138.226.246.94" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a84bb92f-b9c7-5954-bcbf-51eafb5131a7", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "139.28.49.138 (ipv4)", "pattern": "[ipv4-addr:value = '139.28.49.138']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=139.28.49.138" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--911b6e70-d425-59b4-989c-1b4ed448cdc2", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "144.208.127.155 (ipv4)", "pattern": "[ipv4-addr:value = '144.208.127.155']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=144.208.127.155" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--09ad51b2-9b7c-527c-b9ad-29bbcda192e5", "created": "2026-05-30T00:00:00Z", "modified": "2026-05-30T00:00:00Z", "name": "146.19.216.119 (ipv4)", "pattern": "[ipv4-addr:value = '146.19.216.119']", "valid_from": "2026-05-30T00:00:00Z", "valid_until": "2026-05-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=146.19.216.119" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--784bfa1e-e004-56ab-9438-4b54719d5cca", "created": "2026-06-30T00:00:00Z", "modified": "2026-06-30T00:00:00Z", "name": "146.70.139.154 (ipv4)", "pattern": "[ipv4-addr:value = '146.70.139.154']", "valid_from": "2026-06-30T00:00:00Z", "valid_until": "2026-06-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=146.70.139.154" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6554ea23-5b46-5db5-bd04-4f5e03fc5917", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "146.70.169.246 (ipv4)", "pattern": "[ipv4-addr:value = '146.70.169.246']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=146.70.169.246" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a948bb1c-ac0d-543d-b188-48a361182f6b", "created": "2026-08-30T00:00:00Z", "modified": "2026-08-30T00:00:00Z", "name": "146.70.41.178 (ipv4)", "pattern": "[ipv4-addr:value = '146.70.41.178']", "valid_from": "2026-08-30T00:00:00Z", "valid_until": "2026-08-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=146.70.41.178" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--560ad41c-8529-5daf-abc7-976889f7f977", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "152.53.173.29 (ipv4)", "pattern": "[ipv4-addr:value = '152.53.173.29']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=152.53.173.29" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3a925040-63fc-5c8c-9184-8071b9f159e8", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "152.53.173.30 (ipv4)", "pattern": "[ipv4-addr:value = '152.53.173.30']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=152.53.173.30" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd678142-962a-5de0-9fe4-355563f0de07", "created": "2024-02-19T00:00:00Z", "modified": "2024-02-19T00:00:00Z", "name": "155.133.5.14 (ipv4)", "pattern": "[ipv4-addr:value = '155.133.5.14']", "valid_from": "2024-02-19T00:00:00Z", "valid_until": "2024-02-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=155.133.5.14" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6daf4441-dff3-5615-a6d8-ff74c9218f90", "created": "2024-02-19T00:00:00Z", "modified": "2024-02-19T00:00:00Z", "name": "155.133.5.15 (ipv4)", "pattern": "[ipv4-addr:value = '155.133.5.15']", "valid_from": "2024-02-19T00:00:00Z", "valid_until": "2024-02-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=155.133.5.15" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81788783-72e5-5e74-b4a3-702540526f70", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "name": "158.220.87.79 (ipv4)", "pattern": "[ipv4-addr:value = '158.220.87.79']", "valid_from": "2026-08-12T00:00:00Z", "valid_until": "2026-08-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=158.220.87.79" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ffc6208-f70b-55a6-98bf-330df3d0fb41", "created": "2026-04-13T00:00:00Z", "modified": "2026-04-13T00:00:00Z", "name": "160.119.76.250 (ipv4)", "pattern": "[ipv4-addr:value = '160.119.76.250']", "valid_from": "2026-04-13T00:00:00Z", "valid_until": "2026-04-13T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=160.119.76.250" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c9e6aaa5-5f83-5aa1-8da0-12ab47652ba4", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "name": "160.191.242.92 (ipv4)", "pattern": "[ipv4-addr:value = '160.191.242.92']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-09-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=160.191.242.92" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2222c627-e918-5d78-8a91-80320a1b2771", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "name": "160.250.132.238 (ipv4)", "pattern": "[ipv4-addr:value = '160.250.132.238']", "valid_from": "2026-09-14T00:00:00Z", "valid_until": "2026-09-14T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=160.250.132.238" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6d5df32c-01ed-5072-918e-d0ae7ba8611e", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "162.120.71.224 (ipv4)", "pattern": "[ipv4-addr:value = '162.120.71.224']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.120.71.224" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c52227f4-d679-5d04-b4f1-4bbd800987f7", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "name": "162.219.30.165 (ipv4)", "pattern": "[ipv4-addr:value = '162.219.30.165']", "valid_from": "2026-09-25T00:00:00Z", "valid_until": "2026-10-25T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.219.30.165" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a74546e-0e04-58d0-a361-2e5e1bad9917", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "162.33.177.101 (ipv4)", "pattern": "[ipv4-addr:value = '162.33.177.101']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.33.177.101" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--adf9f724-2d98-541f-b741-75e39fdf81f9", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "name": "162.35.122.126 (ipv4)", "pattern": "[ipv4-addr:value = '162.35.122.126']", "valid_from": "2026-09-12T00:00:00Z", "valid_until": "2026-09-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.35.122.126" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f1cc92e4-f4a8-53e8-9f57-215085388f55", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "162.55.0.0 (ipv4)", "pattern": "[ipv4-addr:value = '162.55.0.0']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.55.0.0" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eedbc799-2934-594a-9f95-9251238451e1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "162.55.80.0 (ipv4)", "pattern": "[ipv4-addr:value = '162.55.80.0']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=162.55.80.0" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f29fa4a0-b456-569a-a347-3686973997d2", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "name": "165.154.68.30 (ipv4)", "pattern": "[ipv4-addr:value = '165.154.68.30']", "valid_from": "2026-09-12T00:00:00Z", "valid_until": "2026-09-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=165.154.68.30" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--55c0fd39-eb69-5a93-9546-5730ed667f16", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "name": "165.99.207.153 (ipv4)", "pattern": "[ipv4-addr:value = '165.99.207.153']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-10-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=165.99.207.153" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3b1a4827-6901-511b-adf9-b4a5d8fb2ce5", "created": "2026-08-02T00:00:00Z", "modified": "2026-08-02T00:00:00Z", "name": "166.88.134.62 (ipv4)", "pattern": "[ipv4-addr:value = '166.88.134.62']", "valid_from": "2026-08-02T00:00:00Z", "valid_until": "2026-08-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=166.88.134.62" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4a67b42c-cee1-5302-8d13-724f47eaf04c", "created": "2025-10-20T00:00:00Z", "modified": "2025-10-20T00:00:00Z", "name": "16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8 (sha256)", "pattern": "[file:hashes.SHA-256 = '16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8']", "valid_from": "2025-10-20T00:00:00Z", "valid_until": "2025-10-20T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=16df15306f966ae5c5184901747a32087483c03eebd7bf19dbfc38e2c4d23ff8" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d6b07918-f15f-5106-aafe-b87c9fc191c8", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "172.86.116.8 (ipv4)", "pattern": "[ipv4-addr:value = '172.86.116.8']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=172.86.116.8" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a8c951f7-0ef9-5967-96ae-58440b0b37e3", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "name": "176.65.148.184 (ipv4)", "pattern": "[ipv4-addr:value = '176.65.148.184']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=176.65.148.184" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--61e4d740-c2f6-5aba-b5d2-f8e4bf501927", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "176.65.149.52 (ipv4)", "pattern": "[ipv4-addr:value = '176.65.149.52']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=176.65.149.52" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--21f1de8c-b072-5d5c-967b-d79c83ad365e", "created": "2026-01-28T00:00:00Z", "modified": "2026-01-28T00:00:00Z", "name": "187.108.1.130 (ipv4)", "pattern": "[ipv4-addr:value = '187.108.1.130']", "valid_from": "2026-01-28T00:00:00Z", "valid_until": "2026-01-28T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=187.108.1.130" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--907080b0-7063-5a37-85ed-bf3bd4a20022", "created": "2026-06-06T00:00:00Z", "modified": "2026-06-06T00:00:00Z", "name": "192.236.147.131 (ipv4)", "pattern": "[ipv4-addr:value = '192.236.147.131']", "valid_from": "2026-06-06T00:00:00Z", "valid_until": "2026-06-06T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=192.236.147.131" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26472336-9494-5069-b152-837bf4121b14", "created": "2026-06-06T00:00:00Z", "modified": "2026-06-06T00:00:00Z", "name": "192.236.147.138 (ipv4)", "pattern": "[ipv4-addr:value = '192.236.147.138']", "valid_from": "2026-06-06T00:00:00Z", "valid_until": "2026-06-06T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=192.236.147.138" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9050fc93-4cc5-5c8a-bf86-a5e427d7fee3", "created": "2026-06-30T00:00:00Z", "modified": "2026-06-30T00:00:00Z", "name": "192.42.116.105 (ipv4)", "pattern": "[ipv4-addr:value = '192.42.116.105']", "valid_from": "2026-06-30T00:00:00Z", "valid_until": "2026-06-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=192.42.116.105" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89359964-2aa0-53cb-99a5-994709d98ba6", "created": "2026-06-30T00:00:00Z", "modified": "2026-06-30T00:00:00Z", "name": "192.42.116.58 (ipv4)", "pattern": "[ipv4-addr:value = '192.42.116.58']", "valid_from": "2026-06-30T00:00:00Z", "valid_until": "2026-06-30T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=192.42.116.58" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--88b5072c-3307-5a06-995f-9941b2e44318", "created": "2026-06-06T00:00:00Z", "modified": "2026-06-06T00:00:00Z", "name": "193.141.60.212 (ipv4)", "pattern": "[ipv4-addr:value = '193.141.60.212']", "valid_from": "2026-06-06T00:00:00Z", "valid_until": "2026-06-06T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=193.141.60.212" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--045f5f3f-da23-5d76-abdc-7d90325c401d", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "193.24.211.91 (ipv4)", "pattern": "[ipv4-addr:value = '193.24.211.91']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=193.24.211.91" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4765bb76-e359-5c20-b587-8b90156c8f01", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "193.32.126.168 (ipv4)", "pattern": "[ipv4-addr:value = '193.32.126.168']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=193.32.126.168" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b4a5c88f-b3ea-5af6-aa7d-b27e0a362626", "created": "2026-07-22T00:00:00Z", "modified": "2026-07-22T00:00:00Z", "name": "194.213.18.137 (ipv4)", "pattern": "[ipv4-addr:value = '194.213.18.137']", "valid_from": "2026-07-22T00:00:00Z", "valid_until": "2026-07-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=194.213.18.137" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--09c641d4-c5e7-59dc-bbf9-ffe8a877a2a8", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "name": "194.233.84.90 (ipv4)", "pattern": "[ipv4-addr:value = '194.233.84.90']", "valid_from": "2026-09-20T00:00:00Z", "valid_until": "2026-10-20T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=194.233.84.90" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f44e6465-062f-58c5-a148-630565309510", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "194.48.154.67 (ipv4)", "pattern": "[ipv4-addr:value = '194.48.154.67']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=194.48.154.67" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a00a334e-8bea-567a-b3cb-6016681b107c", "created": "2026-05-13T00:00:00Z", "modified": "2026-05-13T00:00:00Z", "name": "194.58.66.0 (ipv4)", "pattern": "[ipv4-addr:value = '194.58.66.0']", "valid_from": "2026-05-13T00:00:00Z", "valid_until": "2026-05-13T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=194.58.66.0" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3c90981b-ea19-5b51-9bdd-bdba4310186d", "created": "2026-07-27T00:00:00Z", "modified": "2026-07-27T00:00:00Z", "name": "206.72.242.124 (ipv4)", "pattern": "[ipv4-addr:value = '206.72.242.124']", "valid_from": "2026-07-27T00:00:00Z", "valid_until": "2026-07-27T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=206.72.242.124" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--09b12215-6d12-517b-a1c9-6071e5f8f11a", "created": "2026-07-27T00:00:00Z", "modified": "2026-07-27T00:00:00Z", "name": "206.72.242.162 (ipv4)", "pattern": "[ipv4-addr:value = '206.72.242.162']", "valid_from": "2026-07-27T00:00:00Z", "valid_until": "2026-07-27T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=206.72.242.162" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1a06a9f9-3e2e-54d4-aa7d-12ef53ad7be9", "created": "2024-10-24T00:00:00Z", "modified": "2024-10-24T00:00:00Z", "name": "208.115.232.194 (ipv4)", "pattern": "[ipv4-addr:value = '208.115.232.194']", "valid_from": "2024-10-24T00:00:00Z", "valid_until": "2024-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=208.115.232.194" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea7423c9-3d45-5233-a393-9cc62f42e2fe", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "209.182.225.136 (ipv4)", "pattern": "[ipv4-addr:value = '209.182.225.136']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=209.182.225.136" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--37855d97-0d2a-5478-9425-249186d08284", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "212.132.98.170 (ipv4)", "pattern": "[ipv4-addr:value = '212.132.98.170']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=212.132.98.170" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bc962a0e-9678-5b52-bc73-bd55195a2743", "created": "2026-06-22T00:00:00Z", "modified": "2026-06-22T00:00:00Z", "name": "212.86.125.24 (ipv4)", "pattern": "[ipv4-addr:value = '212.86.125.24']", "valid_from": "2026-06-22T00:00:00Z", "valid_until": "2026-06-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=212.86.125.24" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--48bd3182-2a9a-51c8-bdf0-c0f40cf82cec", "created": "2026-06-22T00:00:00Z", "modified": "2026-06-22T00:00:00Z", "name": "213.111.148.90 (ipv4)", "pattern": "[ipv4-addr:value = '213.111.148.90']", "valid_from": "2026-06-22T00:00:00Z", "valid_until": "2026-06-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=213.111.148.90" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ae595a5e-ae75-525e-a320-dfebcc22f1be", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "name": "213.209.159.154 (ipv4)", "pattern": "[ipv4-addr:value = '213.209.159.154']", "valid_from": "2026-09-12T00:00:00Z", "valid_until": "2026-09-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=213.209.159.154" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--37c12752-2a5b-5d68-9af0-b796e7bc09b0", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "216.146.25.208 (ipv4)", "pattern": "[ipv4-addr:value = '216.146.25.208']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=216.146.25.208" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--66cad738-3c5d-56f2-9690-d17b23b5cb0f", "created": "2026-06-26T00:00:00Z", "modified": "2026-06-26T00:00:00Z", "name": "216.152.148.54 (ipv4)", "pattern": "[ipv4-addr:value = '216.152.148.54']", "valid_from": "2026-06-26T00:00:00Z", "valid_until": "2026-06-26T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=216.152.148.54" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0fa4e063-5988-5b8f-bfb2-0ef255d8beb1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "217.154.53.116 (ipv4)", "pattern": "[ipv4-addr:value = '217.154.53.116']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=217.154.53.116" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74089c08-84db-5fa6-851a-322bccf12984", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "217.154.53.187 (ipv4)", "pattern": "[ipv4-addr:value = '217.154.53.187']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=217.154.53.187" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--97972e03-4020-5790-a98c-a7a0c93d4157", "created": "2026-03-12T00:00:00Z", "modified": "2026-03-12T00:00:00Z", "name": "23.225.52.67 (ipv4)", "pattern": "[ipv4-addr:value = '23.225.52.67']", "valid_from": "2026-03-12T00:00:00Z", "valid_until": "2026-03-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=23.225.52.67" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c5fad2d-8ffb-5cdd-b2ff-426d259e7f88", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "name": "23.234.64.0 (ipv4)", "pattern": "[ipv4-addr:value = '23.234.64.0']", "valid_from": "2026-09-08T00:00:00Z", "valid_until": "2026-09-08T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=23.234.64.0" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--98dd5920-3b7a-5a41-80db-d80b62722474", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "name": "26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9 (sha256)", "pattern": "[file:hashes.SHA-256 = '26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9']", "valid_from": "2026-09-07T00:00:00Z", "valid_until": "2026-09-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=26bd5b0722d1dbab5db749a063c49bc8638653ac2addfead7a9cb3d6d57bccc9" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--731d08f9-1d10-5d97-a8d6-5efa09ca7bf3", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "31.177.110.136 (ipv4)", "pattern": "[ipv4-addr:value = '31.177.110.136']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=31.177.110.136" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6ed45fe9-9c75-5a32-af5a-e2c72e473001", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "name": "321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf (sha256)", "pattern": "[file:hashes.SHA-256 = '321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf']", "valid_from": "2026-08-18T00:00:00Z", "valid_until": "2026-08-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--69fc8d2a-a83c-5891-a5ad-9fedb3dcf8ba", "created": "2026-07-20T00:00:00Z", "modified": "2026-07-20T00:00:00Z", "name": "34.153.223.102 (ipv4)", "pattern": "[ipv4-addr:value = '34.153.223.102']", "valid_from": "2026-07-20T00:00:00Z", "valid_until": "2026-07-20T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=34.153.223.102" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29a2c400-6c79-5d39-b62f-b0b03712b650", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "37.32.73.156 (ipv4)", "pattern": "[ipv4-addr:value = '37.32.73.156']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=37.32.73.156" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7cc4bb8b-e93f-5d60-b3f0-1b8170810b41", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "38.54.107.167 (ipv4)", "pattern": "[ipv4-addr:value = '38.54.107.167']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=38.54.107.167" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca7455e-5125-5324-9dfd-375295d3e930", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "38.54.88.201 (ipv4)", "pattern": "[ipv4-addr:value = '38.54.88.201']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=38.54.88.201" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2dea797-9a7c-5428-9655-a6f16ea687b2", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "38.60.157.139 (ipv4)", "pattern": "[ipv4-addr:value = '38.60.157.139']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=38.60.157.139" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7ec6fce4-bfc5-5f41-b879-c4b828347773", "created": "2026-06-26T00:00:00Z", "modified": "2026-06-26T00:00:00Z", "name": "38.60.157.212 (ipv4)", "pattern": "[ipv4-addr:value = '38.60.157.212']", "valid_from": "2026-06-26T00:00:00Z", "valid_until": "2026-06-26T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=38.60.157.212" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c623cd9c-c5d2-5ce3-9104-4f34c011c454", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "name": "38.76.183.197 (ipv4)", "pattern": "[ipv4-addr:value = '38.76.183.197']", "valid_from": "2026-09-10T00:00:00Z", "valid_until": "2026-09-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=38.76.183.197" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9c9edcc5-d9be-54ab-9ef2-1b05453c5747", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "name": "39.96.201.230 (ipv4)", "pattern": "[ipv4-addr:value = '39.96.201.230']", "valid_from": "2026-09-13T00:00:00Z", "valid_until": "2026-09-13T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=39.96.201.230" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c68571d5-5987-53fa-a903-bf3496418d2d", "created": "2026-07-01T00:00:00Z", "modified": "2026-07-01T00:00:00Z", "name": "45.131.66.106 (ipv4)", "pattern": "[ipv4-addr:value = '45.131.66.106']", "valid_from": "2026-07-01T00:00:00Z", "valid_until": "2026-07-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.131.66.106" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8459371b-9505-5dab-a754-608dbbd363ea", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "name": "45.140.205.28 (ipv4)", "pattern": "[ipv4-addr:value = '45.140.205.28']", "valid_from": "2026-09-28T00:00:00Z", "valid_until": "2026-10-28T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.140.205.28" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e8fece8b-75e7-5bae-b1d7-0e0c585e037c", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "45.149.172.51 (ipv4)", "pattern": "[ipv4-addr:value = '45.149.172.51']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.149.172.51" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e8ad0ba-96a0-5f7e-ab39-38f165f59d83", "created": "2026-01-28T00:00:00Z", "modified": "2026-01-28T00:00:00Z", "name": "45.234.176.202 (ipv4)", "pattern": "[ipv4-addr:value = '45.234.176.202']", "valid_from": "2026-01-28T00:00:00Z", "valid_until": "2026-01-28T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.234.176.202" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--45a3c4be-d2be-5d02-9055-903c5aaa440e", "created": "2025-01-14T00:00:00Z", "modified": "2025-01-14T00:00:00Z", "name": "45.55.158.47 (ipv4)", "pattern": "[ipv4-addr:value = '45.55.158.47']", "valid_from": "2025-01-14T00:00:00Z", "valid_until": "2025-01-14T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.55.158.47" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1a770daa-3a36-5e5e-9450-cf0eeef0063b", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "45.61.157.15 (ipv4)", "pattern": "[ipv4-addr:value = '45.61.157.15']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.61.157.15" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa9101b3-7e13-5708-9ff0-004be7c0a041", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "45.76.26.42 (ipv4)", "pattern": "[ipv4-addr:value = '45.76.26.42']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.76.26.42" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b573efe7-0de9-5b10-8a72-8747af5f30d1", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "45.77.149.152 (ipv4)", "pattern": "[ipv4-addr:value = '45.77.149.152']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.77.149.152" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81b76ca5-1b34-53dc-aba3-6586256cfe69", "created": "2023-06-15T00:00:00Z", "modified": "2023-06-15T00:00:00Z", "name": "45.77.212.12 (ipv4)", "pattern": "[ipv4-addr:value = '45.77.212.12']", "valid_from": "2023-06-15T00:00:00Z", "valid_until": "2023-06-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.77.212.12" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a08b55b8-1f6e-5b77-a817-ad2e7726824a", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "name": "45.78.224.85 (ipv4)", "pattern": "[ipv4-addr:value = '45.78.224.85']", "valid_from": "2026-10-01T00:00:00Z", "valid_until": "2026-10-31T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.78.224.85" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--303aeffa-9edb-59cf-baae-e91b1a610e3e", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "45.90.4.121 (ipv4)", "pattern": "[ipv4-addr:value = '45.90.4.121']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.90.4.121" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--846ee127-6dbc-52b5-b593-40de070d95b9", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "45.90.4.128 (ipv4)", "pattern": "[ipv4-addr:value = '45.90.4.128']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.90.4.128" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fefcf15e-57e4-5409-9eb7-714a04b42e27", "created": "2026-04-13T00:00:00Z", "modified": "2026-04-13T00:00:00Z", "name": "45.95.147.178 (ipv4)", "pattern": "[ipv4-addr:value = '45.95.147.178']", "valid_from": "2026-04-13T00:00:00Z", "valid_until": "2026-04-13T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=45.95.147.178" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8febf9de-8ae3-5d5c-ba40-2a8c103c5540", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "name": "47.105.36.109 (ipv4)", "pattern": "[ipv4-addr:value = '47.105.36.109']", "valid_from": "2026-09-29T00:00:00Z", "valid_until": "2026-10-29T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=47.105.36.109" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c7deead7-2c8e-5734-adaa-7ba71fb951bc", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "47.121.130.18 (ipv4)", "pattern": "[ipv4-addr:value = '47.121.130.18']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=47.121.130.18" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea79ef05-4728-5ba6-b5b8-43fbd88233f8", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "name": "47.236.173.77 (ipv4)", "pattern": "[ipv4-addr:value = '47.236.173.77']", "valid_from": "2026-09-11T00:00:00Z", "valid_until": "2026-09-11T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=47.236.173.77" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d6035dbd-f52e-566a-a79a-51568f4d5f22", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "name": "47.94.56.71 (ipv4)", "pattern": "[ipv4-addr:value = '47.94.56.71']", "valid_from": "2026-09-08T00:00:00Z", "valid_until": "2026-09-08T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=47.94.56.71" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f750cef-41c7-574e-86d6-ab930bb777af", "created": "2026-10-04T00:00:00Z", "modified": "2026-10-04T00:00:00Z", "name": "49.0.202.115 (ipv4)", "pattern": "[ipv4-addr:value = '49.0.202.115']", "valid_from": "2026-10-04T00:00:00Z", "valid_until": "2026-11-03T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=49.0.202.115" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3bb6eaed-4f12-5db3-a526-2443381eb0f6", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "name": "49.232.21.222 (ipv4)", "pattern": "[ipv4-addr:value = '49.232.21.222']", "valid_from": "2026-09-29T00:00:00Z", "valid_until": "2026-10-29T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=49.232.21.222" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6401952-8b47-5536-9382-887fae32b9f6", "created": "2026-06-17T00:00:00Z", "modified": "2026-07-25T00:00:00Z", "name": "5.180.41.35 (ipv4)", "pattern": "[ipv4-addr:value = '5.180.41.35']", "valid_from": "2026-06-17T00:00:00Z", "valid_until": "2026-07-25T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "expired", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=5.180.41.35" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--895eb0d4-1ef2-5012-a36a-784ae1adc706", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "51.91.190.241 (ipv4)", "pattern": "[ipv4-addr:value = '51.91.190.241']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=51.91.190.241" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a861ab2a-3d03-5dd0-b4bf-22f257ab99d1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "51.91.190.242 (ipv4)", "pattern": "[ipv4-addr:value = '51.91.190.242']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=51.91.190.242" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--179ef9a1-cad8-579b-b1fc-1cb0916ddee9", "created": "2026-07-01T00:00:00Z", "modified": "2026-07-01T00:00:00Z", "name": "64.20.53.230 (ipv4)", "pattern": "[ipv4-addr:value = '64.20.53.230']", "valid_from": "2026-07-01T00:00:00Z", "valid_until": "2026-07-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=64.20.53.230" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8171d8e6-3527-5236-8903-b95f9fa31422", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "64.62.156.162 (ipv4)", "pattern": "[ipv4-addr:value = '64.62.156.162']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=64.62.156.162" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--945de0aa-ea2f-5768-91bf-5db23488e340", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "64.62.156.222 (ipv4)", "pattern": "[ipv4-addr:value = '64.62.156.222']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=64.62.156.222" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea3a3367-6b74-5823-b294-e7ea160e6a81", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "64.62.156.94 (ipv4)", "pattern": "[ipv4-addr:value = '64.62.156.94']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=64.62.156.94" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f5901aeb-ae60-50a8-aecd-4b6b44b46a5c", "created": "2026-06-06T00:00:00Z", "modified": "2026-06-06T00:00:00Z", "name": "64.94.84.97 (ipv4)", "pattern": "[ipv4-addr:value = '64.94.84.97']", "valid_from": "2026-06-06T00:00:00Z", "valid_until": "2026-06-06T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=64.94.84.97" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d8197a6d-265d-5d70-bd55-608bbff3815c", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "name": "65.109.70.162 (ipv4)", "pattern": "[ipv4-addr:value = '65.109.70.162']", "valid_from": "2026-09-02T00:00:00Z", "valid_until": "2026-09-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=65.109.70.162" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6d37d312-d8c5-51db-9cc8-d23b30db8747", "created": "2026-06-09T00:00:00Z", "modified": "2026-06-09T00:00:00Z", "name": "66.42.99.200 (ipv4)", "pattern": "[ipv4-addr:value = '66.42.99.200']", "valid_from": "2026-06-09T00:00:00Z", "valid_until": "2026-06-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=66.42.99.200" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b79a8471-429e-58be-aaf1-43c9f0bf3f05", "created": "2024-10-24T00:00:00Z", "modified": "2024-10-24T00:00:00Z", "name": "77.247.126.158 (ipv4)", "pattern": "[ipv4-addr:value = '77.247.126.158']", "valid_from": "2024-10-24T00:00:00Z", "valid_until": "2024-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=77.247.126.158" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b33a1662-35e3-5e0c-a681-028fb97a6482", "created": "2026-07-22T00:00:00Z", "modified": "2026-07-22T00:00:00Z", "name": "79.141.160.78 (ipv4)", "pattern": "[ipv4-addr:value = '79.141.160.78']", "valid_from": "2026-07-22T00:00:00Z", "valid_until": "2026-07-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=79.141.160.78" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0f8c600e-9332-545a-a819-6267bcd178fe", "created": "2026-07-27T00:00:00Z", "modified": "2026-07-27T00:00:00Z", "name": "8.19.75.217 (ipv4)", "pattern": "[ipv4-addr:value = '8.19.75.217']", "valid_from": "2026-07-27T00:00:00Z", "valid_until": "2026-07-27T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=8.19.75.217" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--91dd309f-d06f-5474-b7a3-cdd11945f05c", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "82.192.72.4 (ipv4)", "pattern": "[ipv4-addr:value = '82.192.72.4']", "valid_from": "2026-09-05T00:00:00Z", "valid_until": "2026-10-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "active", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=82.192.72.4" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c9afd8e-ab7b-5454-9fb9-1c0016700cad", "created": "2026-06-20T00:00:00Z", "modified": "2026-06-20T00:00:00Z", "name": "85.11.187.8 (ipv4)", "pattern": "[ipv4-addr:value = '85.11.187.8']", "valid_from": "2026-06-20T00:00:00Z", "valid_until": "2026-06-20T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=85.11.187.8" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d37e695-5af9-503b-9b02-4802c9f73d7c", "created": "2026-09-15T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "name": "85.175.101.203 (ipv4)", "pattern": "[ipv4-addr:value = '85.175.101.203']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-11-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=85.175.101.203" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3663e0fc-41a8-5443-b521-199db8180003", "created": "2024-08-22T00:00:00Z", "modified": "2024-08-22T00:00:00Z", "name": "88.119.175.104 (ipv4)", "pattern": "[ipv4-addr:value = '88.119.175.104']", "valid_from": "2024-08-22T00:00:00Z", "valid_until": "2024-08-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=88.119.175.104" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e5a688a-e772-569a-8622-ecec364c7f0b", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "88.214.21.183 (ipv4)", "pattern": "[ipv4-addr:value = '88.214.21.183']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=88.214.21.183" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bb6678c0-89ab-5872-baf3-d8b19372f905", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "name": "8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb (sha256)", "pattern": "[file:hashes.SHA-256 = '8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb']", "valid_from": "2026-09-21T00:00:00Z", "valid_until": "2026-10-21T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f2873dcf-76ea-5c57-b00f-9d44f56cd7ff", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "89.116.171.182 (ipv4)", "pattern": "[ipv4-addr:value = '89.116.171.182']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=89.116.171.182" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bc9f0111-94e1-5598-8f5a-09bcb06c5036", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "89.117.94.35 (ipv4)", "pattern": "[ipv4-addr:value = '89.117.94.35']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=89.117.94.35" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f209ce0e-01db-5b32-9a99-190336e2390e", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "name": "89.126.211.166 (ipv4)", "pattern": "[ipv4-addr:value = '89.126.211.166']", "valid_from": "2026-10-03T00:00:00Z", "valid_until": "2026-11-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=89.126.211.166" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b194b737-e828-5da3-8ee0-a86c606e82b2", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "name": "9.20.4.14 (ipv4)", "pattern": "[ipv4-addr:value = '9.20.4.14']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-09-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=9.20.4.14" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4b765c66-2ef5-596e-9cd5-cbd873d076da", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "name": "91.92.242.30 (ipv4)", "pattern": "[ipv4-addr:value = '91.92.242.30']", "valid_from": "2026-08-20T00:00:00Z", "valid_until": "2026-08-20T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=91.92.242.30" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2457fe3b-935a-5ec2-8200-c1f4030c52ef", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "name": "92.63.180.133 (ipv4)", "pattern": "[ipv4-addr:value = '92.63.180.133']", "valid_from": "2026-09-14T00:00:00Z", "valid_until": "2026-09-14T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=92.63.180.133" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e7400b29-6fee-554f-9c74-b9206e36ba17", "created": "2026-06-22T00:00:00Z", "modified": "2026-06-22T00:00:00Z", "name": "94.154.32.160 (ipv4)", "pattern": "[ipv4-addr:value = '94.154.32.160']", "valid_from": "2026-06-22T00:00:00Z", "valid_until": "2026-06-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=94.154.32.160" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a7709629-7a3a-5970-a835-a550ff4e3e25", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "name": "96.62.224.81 (ipv4)", "pattern": "[ipv4-addr:value = '96.62.224.81']", "valid_from": "2026-09-28T00:00:00Z", "valid_until": "2026-10-28T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=96.62.224.81" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--04822ac3-3063-54fb-98c7-39d19eed6a86", "created": "2026-08-23T00:00:00Z", "modified": "2026-08-23T00:00:00Z", "name": "abacusadv.com (domain)", "pattern": "[domain-name:value = 'abacusadv.com']", "valid_from": "2026-08-23T00:00:00Z", "valid_until": "2026-08-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=abacusadv.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f17ec391-fcfc-5f2e-8885-af4edcaa5492", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "name": "adminmenueditor.com (domain)", "pattern": "[domain-name:value = 'adminmenueditor.com']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-10-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=adminmenueditor.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--de6d5f41-0178-5984-a6a0-cdb9bb9504ff", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "name": "ai-thermal.com (domain)", "pattern": "[domain-name:value = 'ai-thermal.com']", "valid_from": "2026-08-27T00:00:00Z", "valid_until": "2026-08-27T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=ai-thermal.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dfc6d243-c4c5-5d85-8bee-0978dacd974f", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "alduncanson.react (domain)", "pattern": "[domain-name:value = 'alduncanson.react']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=alduncanson.react" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--92181a30-0506-5d02-87c9-6f2769dcc9f5", "created": "2026-08-10T00:00:00Z", "modified": "2026-08-10T00:00:00Z", "name": "analysis.abyssos (domain)", "pattern": "[domain-name:value = 'analysis.abyssos']", "valid_from": "2026-08-10T00:00:00Z", "valid_until": "2026-08-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=analysis.abyssos" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6164fe7d-603c-5a68-9b07-d56cd03419e7", "created": "2026-08-05T00:00:00Z", "modified": "2026-08-05T00:00:00Z", "name": "api.claudeopus (domain)", "pattern": "[domain-name:value = 'api.claudeopus']", "valid_from": "2026-08-05T00:00:00Z", "valid_until": "2026-08-05T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=api.claudeopus" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9e497f0f-2744-5da1-a6b8-44c670f9809d", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "api.telegram.org (domain)", "pattern": "[domain-name:value = 'api.telegram.org']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=api.telegram.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28b98dc6-9b5e-5d1e-9222-19d6fa7c9a75", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "api.virtualizor.com (domain)", "pattern": "[domain-name:value = 'api.virtualizor.com']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=api.virtualizor.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e82f915e-f07a-5eb6-bc19-75f40dcf27ed", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "name": "api.weatherlive (domain)", "pattern": "[domain-name:value = 'api.weatherlive']", "valid_from": "2026-10-08T00:00:00Z", "valid_until": "2026-11-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=api.weatherlive" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0467e51e-4c2c-5ca7-9705-d17ebab2e7aa", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "apply.fbijobs.gov (domain)", "pattern": "[domain-name:value = 'apply.fbijobs.gov']", "valid_from": "2026-09-22T00:00:00Z", "valid_until": "2026-09-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "revoked", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=apply.fbijobs.gov" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d6a1f9a3-820b-5180-bc20-1642b356ad9c", "created": "2026-05-23T00:00:00Z", "modified": "2026-05-23T00:00:00Z", "name": "autoload.files (domain)", "pattern": "[domain-name:value = 'autoload.files']", "valid_from": "2026-05-23T00:00:00Z", "valid_until": "2026-05-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=autoload.files" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1c5f9ef4-2afd-5c91-8e5e-e13a32693aaa", "created": "2026-06-23T00:00:00Z", "modified": "2026-06-23T00:00:00Z", "name": "avbuffer.free (domain)", "pattern": "[domain-name:value = 'avbuffer.free']", "valid_from": "2026-06-23T00:00:00Z", "valid_until": "2026-06-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=avbuffer.free" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--beaac412-23fc-5063-9f99-50abd38dce2e", "created": "2026-08-07T00:00:00Z", "modified": "2026-08-07T00:00:00Z", "name": "awqhnjewqjkl.icu (domain)", "pattern": "[domain-name:value = 'awqhnjewqjkl.icu']", "valid_from": "2026-08-07T00:00:00Z", "valid_until": "2026-08-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=awqhnjewqjkl.icu" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--be993fd3-d443-5166-a27d-5ab69e8937a5", "created": "2026-06-11T00:00:00Z", "modified": "2026-06-11T00:00:00Z", "name": "azurenetfiles.net (domain)", "pattern": "[domain-name:value = 'azurenetfiles.net']", "valid_from": "2026-06-11T00:00:00Z", "valid_until": "2026-06-11T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=azurenetfiles.net" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--802c6a3a-0484-5ecc-830b-eae932fe8e0e", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "backblazeb2.com (domain)", "pattern": "[domain-name:value = 'backblazeb2.com']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=backblazeb2.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed864c60-894d-5573-8795-8ae32eaf41bb", "created": "2026-06-16T00:00:00Z", "modified": "2026-06-16T00:00:00Z", "name": "backdoor.turn (domain)", "pattern": "[domain-name:value = 'backdoor.turn']", "valid_from": "2026-06-16T00:00:00Z", "valid_until": "2026-06-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=backdoor.turn" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d474d52f-7234-53ab-a156-34e1c79c6e35", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e (sha256)", "pattern": "[file:hashes.SHA-256 = 'bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e']", "valid_from": "2026-09-22T00:00:00Z", "valid_until": "2026-10-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=bf0681e43f51e98fe7ec24bf73a43facc66b0feb325a3a835f8f01b2861b926e" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--80ef448e-e9fd-5e8e-a4a1-b666e676cdfd", "created": "2026-03-27T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "name": "bigtlog.pipe (domain)", "pattern": "[domain-name:value = 'bigtlog.pipe']", "valid_from": "2026-03-27T00:00:00Z", "valid_until": "2026-09-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "expired", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=bigtlog.pipe" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3e6da016-3580-543f-b12e-5d4d1ce724cc", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "brmconfig.com (domain)", "pattern": "[domain-name:value = 'brmconfig.com']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=brmconfig.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1c553fb3-9d89-5311-a569-81f3f653e647", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "name": "caldav.icloud (domain)", "pattern": "[domain-name:value = 'caldav.icloud']", "valid_from": "2026-09-24T00:00:00Z", "valid_until": "2026-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=caldav.icloud" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b0c750f8-0f46-5fde-8afa-13cba60b7580", "created": "2026-06-26T00:00:00Z", "modified": "2026-06-26T00:00:00Z", "name": "canal1zac1a.onrender.com (domain)", "pattern": "[domain-name:value = 'canal1zac1a.onrender.com']", "valid_from": "2026-06-26T00:00:00Z", "valid_until": "2026-06-26T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=canal1zac1a.onrender.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6c0e0f4d-cdde-5de8-874a-d01742c3c487", "created": "2026-08-10T00:00:00Z", "modified": "2026-08-10T00:00:00Z", "name": "capabilities.abyssos (domain)", "pattern": "[domain-name:value = 'capabilities.abyssos']", "valid_from": "2026-08-10T00:00:00Z", "valid_until": "2026-08-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=capabilities.abyssos" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15615ad7-0a82-5ce6-a3f5-5ac639511cce", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "name": "cdn.bloom (domain)", "pattern": "[domain-name:value = 'cdn.bloom']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-09-09T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cdn.bloom" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--be8def67-2ef5-5531-b445-849f96b6a350", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "cdn10.sendibt1.com (domain)", "pattern": "[domain-name:value = 'cdn10.sendibt1.com']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cdn10.sendibt1.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a5d40854-fe03-559e-8b56-f5eb40372f9e", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "cdn11.sendibt1.com (domain)", "pattern": "[domain-name:value = 'cdn11.sendibt1.com']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cdn11.sendibt1.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--41838d2a-5416-5bc8-86f4-600d4e507b2f", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "cdn2.sendibt1.com (domain)", "pattern": "[domain-name:value = 'cdn2.sendibt1.com']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cdn2.sendibt1.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d7694605-d382-5f06-a28e-be9f02f93a82", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "cdn4.sendibt1.com (domain)", "pattern": "[domain-name:value = 'cdn4.sendibt1.com']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cdn4.sendibt1.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b49d32bf-13c3-5ea3-a87a-0c8e528da1cd", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "name": "city-forum.com (domain)", "pattern": "[domain-name:value = 'city-forum.com']", "valid_from": "2026-08-12T00:00:00Z", "valid_until": "2026-08-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=city-forum.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2c5a2a85-6abe-5221-a60b-45ce2e815fdf", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "name": "com.android.sys.bcprot (domain)", "pattern": "[domain-name:value = 'com.android.sys.bcprot']", "valid_from": "2026-10-08T00:00:00Z", "valid_until": "2026-11-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.android.sys.bcprot" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0c9debd-a670-571b-8d1a-740f768b2eaa", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "name": "com.android.sys.gmsprot (domain)", "pattern": "[domain-name:value = 'com.android.sys.gmsprot']", "valid_from": "2026-10-08T00:00:00Z", "valid_until": "2026-11-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.android.sys.gmsprot" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb5d2924-0b51-5ce2-af5c-0a31ab13cd30", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "name": "com.android.sys.prot (domain)", "pattern": "[domain-name:value = 'com.android.sys.prot']", "valid_from": "2026-10-08T00:00:00Z", "valid_until": "2026-11-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.android.sys.prot" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cecc243f-07ed-5e43-b038-c36b8de69c14", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "name": "com.android.system.lite (domain)", "pattern": "[domain-name:value = 'com.android.system.lite']", "valid_from": "2026-10-08T00:00:00Z", "valid_until": "2026-11-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.android.system.lite" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--259dd955-0356-5455-af6d-c91c3a2e2d14", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "name": "com.apple.finder.agent (domain)", "pattern": "[domain-name:value = 'com.apple.finder.agent']", "valid_from": "2026-09-24T00:00:00Z", "valid_until": "2026-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.apple.finder.agent" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--230c4d30-6ca4-5bd8-81f9-9c86d3150d6e", "created": "2026-06-24T00:00:00Z", "modified": "2026-06-24T00:00:00Z", "name": "com.apple.system.services.activity (domain)", "pattern": "[domain-name:value = 'com.apple.system.services.activity']", "valid_from": "2026-06-24T00:00:00Z", "valid_until": "2026-06-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.apple.system.services.activity" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d055f91-c7de-5edc-82c3-266a3c866000", "created": "2025-12-10T00:00:00Z", "modified": "2025-12-10T00:00:00Z", "name": "com.finder.helper.plist (domain)", "pattern": "[domain-name:value = 'com.finder.helper.plist']", "valid_from": "2025-12-10T00:00:00Z", "valid_until": "2025-12-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.finder.helper.plist" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4c6bbd38-a085-57a4-8a35-06002ba4bf60", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "name": "com.utils.launcher (domain)", "pattern": "[domain-name:value = 'com.utils.launcher']", "valid_from": "2026-09-10T00:00:00Z", "valid_until": "2026-09-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=com.utils.launcher" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--24200dd7-847f-533d-b85a-6d0b6b4d0e6e", "created": "2025-07-07T00:00:00Z", "modified": "2025-07-07T00:00:00Z", "name": "comfyupdate.org (domain)", "pattern": "[domain-name:value = 'comfyupdate.org']", "valid_from": "2025-07-07T00:00:00Z", "valid_until": "2025-07-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=comfyupdate.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4cc17d89-6dfc-5812-bcec-cf95fc445333", "created": "2026-08-10T00:00:00Z", "modified": "2026-08-10T00:00:00Z", "name": "communication.abyssos (domain)", "pattern": "[domain-name:value = 'communication.abyssos']", "valid_from": "2026-08-10T00:00:00Z", "valid_until": "2026-08-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=communication.abyssos" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4131040-d6e7-5bd9-ac0e-c3a94a0ebf32", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "company.onmicrosoft.com (domain)", "pattern": "[domain-name:value = 'company.onmicrosoft.com']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=company.onmicrosoft.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89f48f5f-e9e5-5759-b3aa-46fa9f643d69", "created": "2026-03-12T00:00:00Z", "modified": "2026-03-12T00:00:00Z", "name": "cre-ads.com (domain)", "pattern": "[domain-name:value = 'cre-ads.com']", "valid_from": "2026-03-12T00:00:00Z", "valid_until": "2026-03-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cre-ads.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--deb371b3-9273-5c2b-9134-f34db26599e4", "created": "2026-09-09T00:00:00Z", "modified": "2026-10-13T00:00:00Z", "name": "cybersecurefox.com (domain)", "pattern": "[domain-name:value = 'cybersecurefox.com']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-11-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "active", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=cybersecurefox.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1b864d13-24b3-5fb1-9e31-17ca3f425276", "created": "2026-05-02T00:00:00Z", "modified": "2026-05-02T00:00:00Z", "name": "daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209 (sha256)", "pattern": "[file:hashes.SHA-256 = 'daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209']", "valid_from": "2026-05-02T00:00:00Z", "valid_until": "2026-05-02T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=daf619aa8cc74dab02c360f46f9f4b7b1654ba478ee89992a3512a46f1f4c209" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa823f73-971d-5294-9dc2-20ff22bf3a55", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "daymath.mjs (domain)", "pattern": "[domain-name:value = 'daymath.mjs']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=daymath.mjs" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--08035d0a-a07e-5512-bcb9-2825fcb2174d", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "name": "delivery.evidence (domain)", "pattern": "[domain-name:value = 'delivery.evidence']", "valid_from": "2026-08-11T00:00:00Z", "valid_until": "2026-08-11T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=delivery.evidence" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7d8d9d26-d2a3-5901-bad2-781bd309d5cf", "created": "2026-06-26T00:00:00Z", "modified": "2026-06-26T00:00:00Z", "name": "driverx86-adobe.onrender.com (domain)", "pattern": "[domain-name:value = 'driverx86-adobe.onrender.com']", "valid_from": "2026-06-26T00:00:00Z", "valid_until": "2026-06-26T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=driverx86-adobe.onrender.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4915f94a-cae0-59e6-a331-7e8140c30431", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "name": "e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6 (sha256)", "pattern": "[file:hashes.SHA-256 = 'e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6']", "valid_from": "2026-09-08T00:00:00Z", "valid_until": "2026-09-08T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9713eafb-b24a-5866-9ea9-5f88f2c363b8", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "name": "eeongous.com (domain)", "pattern": "[domain-name:value = 'eeongous.com']", "valid_from": "2026-09-04T00:00:00Z", "valid_until": "2026-09-04T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=eeongous.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--514cc1ac-8098-56cc-8c1e-e1480c8f9200", "created": "2026-05-05T00:00:00Z", "modified": "2026-05-05T00:00:00Z", "name": "env-check.daemontools (domain)", "pattern": "[domain-name:value = 'env-check.daemontools']", "valid_from": "2026-05-05T00:00:00Z", "valid_until": "2026-05-05T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=env-check.daemontools" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f5e0cbaf-f385-59e8-b4b0-5edcc8d39498", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "files.virtualizor.com (domain)", "pattern": "[domain-name:value = 'files.virtualizor.com']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=files.virtualizor.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1cb84f61-9527-5a68-bdb5-fe1926ea11ca", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "name": "gateway.icloud (domain)", "pattern": "[domain-name:value = 'gateway.icloud']", "valid_from": "2026-09-24T00:00:00Z", "valid_until": "2026-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=gateway.icloud" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0ef93807-8ece-53ff-b34d-33cb078e8569", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "name": "git.churchofmalware (domain)", "pattern": "[domain-name:value = 'git.churchofmalware']", "valid_from": "2026-08-12T00:00:00Z", "valid_until": "2026-08-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=git.churchofmalware" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b25c138f-651a-5cc7-af82-e74ac3c1b751", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "name": "git.projectnightcrawler (domain)", "pattern": "[domain-name:value = 'git.projectnightcrawler']", "valid_from": "2026-08-12T00:00:00Z", "valid_until": "2026-08-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=git.projectnightcrawler" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--812e0780-1f29-51b4-b6eb-cb03da43ba67", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "name": "github.aoitour (domain)", "pattern": "[domain-name:value = 'github.aoitour']", "valid_from": "2026-08-14T00:00:00Z", "valid_until": "2026-08-14T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=github.aoitour" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2053c10b-d7ee-5eed-822b-be394eb0eb0c", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "name": "gogets.dev (domain)", "pattern": "[domain-name:value = 'gogets.dev']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=gogets.dev" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--168db781-209e-5bb9-afd5-610f4f867400", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "gs.thc.org (domain)", "pattern": "[domain-name:value = 'gs.thc.org']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=gs.thc.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--40e2c2ce-a748-5467-9589-9bec9a06a64f", "created": "2026-03-23T00:00:00Z", "modified": "2026-03-23T00:00:00Z", "name": "index-ap3.tyler2miler-proton-me-s-account.workers.dev (domain)", "pattern": "[domain-name:value = 'index-ap3.tyler2miler-proton-me-s-account.workers.dev']", "valid_from": "2026-03-23T00:00:00Z", "valid_until": "2026-03-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=index-ap3.tyler2miler-proton-me-s-account.workers.dev" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9964fe8c-85f0-53b5-9b18-73bae08536f1", "created": "2026-08-15T00:00:00Z", "modified": "2026-08-15T00:00:00Z", "name": "ipssrl.com (domain)", "pattern": "[domain-name:value = 'ipssrl.com']", "valid_from": "2026-08-15T00:00:00Z", "valid_until": "2026-08-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=ipssrl.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--453690d0-0aa7-5693-93ce-c478b55c543b", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "name": "itorrents.org (domain)", "pattern": "[domain-name:value = 'itorrents.org']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-09-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=itorrents.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--82ea33c5-4851-5899-8dfa-5c11da85fde9", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "name": "laboo.boo (domain)", "pattern": "[domain-name:value = 'laboo.boo']", "valid_from": "2026-09-04T00:00:00Z", "valid_until": "2026-09-04T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=laboo.boo" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--492b56c0-ac1f-5797-aca6-54a7386fc2a6", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "name": "leappoach.info (domain)", "pattern": "[domain-name:value = 'leappoach.info']", "valid_from": "2026-09-04T00:00:00Z", "valid_until": "2026-09-04T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=leappoach.info" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74cd7d06-e96f-5b40-b2b1-1b300487867f", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "magne-sjaastad.opm (domain)", "pattern": "[domain-name:value = 'magne-sjaastad.opm']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=magne-sjaastad.opm" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ddebb5cb-f7cd-59db-8ba6-26829d46a440", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "name": "mail.uaiubifas (domain)", "pattern": "[domain-name:value = 'mail.uaiubifas']", "valid_from": "2026-09-10T00:00:00Z", "valid_until": "2026-09-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=mail.uaiubifas" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7cc4a874-3acd-5f6f-9204-d82eef7899ab", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "name": "mythtime.xyz (domain)", "pattern": "[domain-name:value = 'mythtime.xyz']", "valid_from": "2026-09-04T00:00:00Z", "valid_until": "2026-09-04T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=mythtime.xyz" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--13682070-c3f5-59db-8842-00fb792f3a4e", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "nightmare-stresser.com (domain)", "pattern": "[domain-name:value = 'nightmare-stresser.com']", "valid_from": "2026-09-22T00:00:00Z", "valid_until": "2026-09-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=nightmare-stresser.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a4e4881d-6bed-588e-bdac-74d72205e390", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "name": "nightmarestresser.org (domain)", "pattern": "[domain-name:value = 'nightmarestresser.org']", "valid_from": "2026-09-22T00:00:00Z", "valid_until": "2026-09-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=nightmarestresser.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--27c856f5-29a1-5ac4-a8ca-ab12ead455e9", "created": "2026-03-12T00:00:00Z", "modified": "2026-03-12T00:00:00Z", "name": "nqsaaskw.com (domain)", "pattern": "[domain-name:value = 'nqsaaskw.com']", "valid_from": "2026-03-12T00:00:00Z", "valid_until": "2026-03-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=nqsaaskw.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--14d2d1aa-4aaa-559b-b17f-2f205b8af2cf", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "openai-backup.one (domain)", "pattern": "[domain-name:value = 'openai-backup.one']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=openai-backup.one" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--28180bbe-3076-51c8-b1b9-8d4c383bdc8f", "created": "2026-08-04T00:00:00Z", "modified": "2026-08-04T00:00:00Z", "name": "poison-claude.bitsender (domain)", "pattern": "[domain-name:value = 'poison-claude.bitsender']", "valid_from": "2026-08-04T00:00:00Z", "valid_until": "2026-08-04T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=poison-claude.bitsender" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dfe3a1f3-9c30-5cac-ad5f-e1f24e68676e", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "name": "pool.hashvault (domain)", "pattern": "[domain-name:value = 'pool.hashvault']", "valid_from": "2026-08-27T00:00:00Z", "valid_until": "2026-08-27T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=pool.hashvault" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b4b2bd7f-a21f-5cd0-8ebc-806f5a93fbe2", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "name": "registry.coder.com (domain)", "pattern": "[domain-name:value = 'registry.coder.com']", "valid_from": "2026-09-03T00:00:00Z", "valid_until": "2026-09-08T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 70, "x_tia_status": "expired", "x_tia_confidence": "corroborated", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=registry.coder.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0992d352-712a-50fc-9f92-b4c1caf6cf80", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "reliaquest.claims (domain)", "pattern": "[domain-name:value = 'reliaquest.claims']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=reliaquest.claims" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--03c5352e-7dd8-5570-ab80-b599eb8d5bd3", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "name": "review.chm (domain)", "pattern": "[domain-name:value = 'review.chm']", "valid_from": "2026-08-12T00:00:00Z", "valid_until": "2026-08-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=review.chm" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa0f2707-22d6-5823-87e6-4b5ed5097cca", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "rumbledb.jsoniq (domain)", "pattern": "[domain-name:value = 'rumbledb.jsoniq']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=rumbledb.jsoniq" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--504c04ff-bd52-5751-ac67-5cd3b7a46b52", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "name": "sendibt1.com (domain)", "pattern": "[domain-name:value = 'sendibt1.com']", "valid_from": "2026-09-18T00:00:00Z", "valid_until": "2026-10-18T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=sendibt1.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d801cf53-ef85-5b6f-b191-31a3f0b02413", "created": "2026-06-08T00:00:00Z", "modified": "2026-06-08T00:00:00Z", "name": "setup.mdc (domain)", "pattern": "[domain-name:value = 'setup.mdc']", "valid_from": "2026-06-08T00:00:00Z", "valid_until": "2026-06-08T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=setup.mdc" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--659ccfa5-a3e0-5898-9e3a-b372058da197", "created": "2026-08-05T00:00:00Z", "modified": "2026-08-05T00:00:00Z", "name": "setup.mjs (domain)", "pattern": "[domain-name:value = 'setup.mjs']", "valid_from": "2026-08-05T00:00:00Z", "valid_until": "2026-08-05T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=setup.mjs" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0e3f5130-f79a-5e36-892e-5ae66aa921c2", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "name": "sphealth.aspx (domain)", "pattern": "[domain-name:value = 'sphealth.aspx']", "valid_from": "2026-09-24T00:00:00Z", "valid_until": "2026-10-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=sphealth.aspx" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--64490697-2e4d-523c-a760-7c3fcd8dbc0a", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "name": "stonevillenc.org (domain)", "pattern": "[domain-name:value = 'stonevillenc.org']", "valid_from": "2026-09-11T00:00:00Z", "valid_until": "2026-09-11T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=stonevillenc.org" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--095c1c75-7d4d-5813-bba0-30f5e91bfb77", "created": "2025-07-07T00:00:00Z", "modified": "2025-07-07T00:00:00Z", "name": "synologyupdates.com (domain)", "pattern": "[domain-name:value = 'synologyupdates.com']", "valid_from": "2025-07-07T00:00:00Z", "valid_until": "2025-07-07T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=synologyupdates.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--81a1984e-9959-5c2c-a1c1-a06a0b620755", "created": "2026-07-08T00:00:00Z", "modified": "2026-07-10T00:00:00Z", "name": "sys.rzadmin.password (domain)", "pattern": "[domain-name:value = 'sys.rzadmin.password']", "valid_from": "2026-07-08T00:00:00Z", "valid_until": "2026-07-10T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=sys.rzadmin.password" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--804c51dd-bd5c-5572-88ce-2c8de50b7822", "created": "2026-08-15T00:00:00Z", "modified": "2026-08-15T00:00:00Z", "name": "tappercuddy.com (domain)", "pattern": "[domain-name:value = 'tappercuddy.com']", "valid_from": "2026-08-15T00:00:00Z", "valid_until": "2026-08-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=tappercuddy.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29f8703c-34d2-51ad-8462-d4e2e33c5139", "created": "2026-05-02T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "name": "third-party.com (domain)", "pattern": "[domain-name:value = 'third-party.com']", "valid_from": "2026-05-02T00:00:00Z", "valid_until": "2026-10-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=third-party.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a68c1308-96cd-5751-a147-b22cd8c0775b", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "name": "trainingannouncement.pdf.lnk (domain)", "pattern": "[domain-name:value = 'trainingannouncement.pdf.lnk']", "valid_from": "2026-08-19T00:00:00Z", "valid_until": "2026-08-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=trainingannouncement.pdf.lnk" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c28980c1-24b3-50b0-a4f1-49ac2543ecc4", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "name": "trendaisecurity.com (domain)", "pattern": "[domain-name:value = 'trendaisecurity.com']", "valid_from": "2026-08-24T00:00:00Z", "valid_until": "2026-08-24T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=trendaisecurity.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--73c99b51-2960-5b4d-8b6f-842b8aff095b", "created": "2026-03-12T00:00:00Z", "modified": "2026-03-12T00:00:00Z", "name": "userstat.net (domain)", "pattern": "[domain-name:value = 'userstat.net']", "valid_from": "2026-03-12T00:00:00Z", "valid_until": "2026-03-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=userstat.net" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a13d2247-959b-5b8d-98a0-d2bcd9bbc2e0", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "name": "usher.ttvnw (domain)", "pattern": "[domain-name:value = 'usher.ttvnw']", "valid_from": "2026-09-14T00:00:00Z", "valid_until": "2026-09-14T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=usher.ttvnw" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f21d21a0-d680-5ed5-ab40-60635c11077a", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "name": "virtualizor.com (domain)", "pattern": "[domain-name:value = 'virtualizor.com']", "valid_from": "2026-09-01T00:00:00Z", "valid_until": "2026-09-01T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=virtualizor.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--874f649a-99b9-5224-8170-0986d7b31e26", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "name": "vlxx.arm (domain)", "pattern": "[domain-name:value = 'vlxx.arm']", "valid_from": "2026-09-09T00:00:00Z", "valid_until": "2026-09-11T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=vlxx.arm" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--53db3f3c-201a-547b-8999-07110ec064fd", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "name": "vultrobjects.com (domain)", "pattern": "[domain-name:value = 'vultrobjects.com']", "valid_from": "2026-09-16T00:00:00Z", "valid_until": "2026-10-16T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=vultrobjects.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--56b69a04-5eee-572c-8c75-325e9c689a95", "created": "2026-06-26T00:00:00Z", "modified": "2026-06-26T00:00:00Z", "name": "weatherdataai.theworkpc.com (domain)", "pattern": "[domain-name:value = 'weatherdataai.theworkpc.com']", "valid_from": "2026-06-26T00:00:00Z", "valid_until": "2026-06-26T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=weatherdataai.theworkpc.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6a58cf1b-250d-5c08-8d05-23ac10bc035e", "created": "2026-09-15T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "name": "witha.name (domain)", "pattern": "[domain-name:value = 'witha.name']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-11-05T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=witha.name" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--056a464f-17ea-526b-ab57-0d419fc94f73", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "name": "wp-user-consent.php (domain)", "pattern": "[domain-name:value = 'wp-user-consent.php']", "valid_from": "2026-09-15T00:00:00Z", "valid_until": "2026-10-15T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "active", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=wp-user-consent.php" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d81e33fa-ca22-55e7-b747-94122e95e4d1", "created": "2026-07-17T00:00:00Z", "modified": "2026-07-19T00:00:00Z", "name": "wp2shell.com (domain)", "pattern": "[domain-name:value = 'wp2shell.com']", "valid_from": "2026-07-17T00:00:00Z", "valid_until": "2026-07-19T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=wp2shell.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a6993a2f-069e-51a2-b2f5-3c56ad17a29f", "created": "2026-03-12T00:00:00Z", "modified": "2026-03-12T00:00:00Z", "name": "xemphimlau.com (domain)", "pattern": "[domain-name:value = 'xemphimlau.com']", "valid_from": "2026-03-12T00:00:00Z", "valid_until": "2026-03-12T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=xemphimlau.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--78dff1f2-7c3a-5019-a47c-ab905b1a42ea", "created": "2026-07-23T00:00:00Z", "modified": "2026-07-23T00:00:00Z", "name": "zimbra-metadata.com (domain)", "pattern": "[domain-name:value = 'zimbra-metadata.com']", "valid_from": "2026-07-23T00:00:00Z", "valid_until": "2026-07-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=zimbra-metadata.com" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5e0e76a1-a800-5b1a-8aa7-58df9afcd43c", "created": "2025-12-22T00:00:00Z", "modified": "2025-12-22T00:00:00Z", "name": "zk-call-messenger-installer-3.9.2-lts.dmg (domain)", "pattern": "[domain-name:value = 'zk-call-messenger-installer-3.9.2-lts.dmg']", "valid_from": "2025-12-22T00:00:00Z", "valid_until": "2025-12-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=zk-call-messenger-installer-3.9.2-lts.dmg" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d7a3e9da-305c-5231-8a9c-4a4d0c896899", "created": "2025-12-22T00:00:00Z", "modified": "2025-12-22T00:00:00Z", "name": "zkcall.net (domain)", "pattern": "[domain-name:value = 'zkcall.net']", "valid_from": "2025-12-22T00:00:00Z", "valid_until": "2025-12-22T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "revoked", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=zkcall.net" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--821bd0e0-aed6-5a27-a753-f39f1660449d", "created": "2026-07-23T00:00:00Z", "modified": "2026-07-23T00:00:00Z", "name": "zmailanalytics.com (domain)", "pattern": "[domain-name:value = 'zmailanalytics.com']", "valid_from": "2026-07-23T00:00:00Z", "valid_until": "2026-07-23T00:00:00Z", "labels": [ "malicious-activity" ], "confidence": 40, "x_tia_status": "expired", "x_tia_confidence": "reported", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iocs/?q=zmailanalytics.com" } ] }, { "type": "malware", "id": "malware--7744e1d8-ad8e-5345-bb59-a884135b4cee", "name": "2CLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/2cloader-a-new-malware-loader-delivering-vidar-and-remus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1497", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--c2284227-0267-5037-b475-3cd2ec6a1e08", "name": "AI-assisted polymorphic malware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malware-that-phones-home-to-gemini-and-hugging-face-just-to-rewr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1059", "T1027", "T1102", "T1041" ] }, { "type": "malware", "id": "malware--d18c6692-6469-51b9-b737-a3d6fdc0169a", "name": "ATMii", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--963e6bf5-f928-5638-8af3-154881651b85", "name": "ATMitch", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--76ce127a-1a60-5be2-9745-c96d2dc46894", "name": "Abyssos", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/abyssos-rat-hijacks-browser-sessions-steals-credentials-and-give/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1219", "T1185", "T1555", "T1056", "T1105", "T1027" ] }, { "type": "malware", "id": "malware--35613006-f320-53fb-8661-4f9afa431191", "name": "Acreed", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--d9ffade2-715c-55e4-892a-5e940df80cc3", "name": "Acreed", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--8c6a7876-76ba-5862-b3fc-6e0c7d3fd46e", "name": "Aeternum", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/aeternum-botnet-runs-entire-c2-stack-on-the-polygon-blockchain/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1063" } ], "labels": [ "T1071", "T1497", "T1063" ] }, { "type": "malware", "id": "malware--e58f07ed-6b40-5f4d-aa1d-6df45df1f8bf", "name": "Aeternum", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/aeternum-botnet-hides-c2-infrastructure-in-polygon-smart-contrac/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1059", "T1547", "T1573", "T1105" ] }, { "type": "malware", "id": "malware--cd494981-596b-53d2-9c49-6610e54080d0", "name": "Agent Tesla v4", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-22T00:00:00Z", "modified": "2026-08-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/agent-tesla-malware-campaign-uses-emoji-obfuscation-to-steal-cre/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1566", "T1059", "T1027", "T1555" ] }, { "type": "malware", "id": "malware--e5a0a954-12ff-54ff-a4a5-e0be8a39e2cc", "name": "AiLock ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-11T00:00:00Z", "modified": "2026-10-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ailock-ransomware-strikes-morgan-services-inc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "malware", "id": "malware--f130b0b0-d992-5ec9-aa26-d6f1dece7099", "name": "Aisuru", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimwolf-botnet-rebuilt-to-survive-takedowns-researchers-say/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1568" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1498", "T1071", "T1568", "T1573", "T1036", "T1090" ] }, { "type": "malware", "id": "malware--b223d928-a3d6-5836-aaef-2528eac9882d", "name": "Akira ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/akira-ransomware-group-claims-stransky-heiz-mess-regeltechnik-gm/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "malware", "id": "malware--e8d90b86-cd09-5a18-bb85-20cd54e19b2e", "name": "Akira ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/one-missing-mfa-control-lets-credential-spray-become-full-akira/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1688" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1110", "T1078", "T1688", "T1486", "T1562" ] }, { "type": "malware", "id": "malware--a0427ae4-7392-506e-a45e-26bc33156269", "name": "Alice", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--f77f981a-7fdc-5318-8c12-c89a699057f2", "name": "Alinubx.sys (EDR killer)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infos/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1195", "T1574", "T1073", "T1562", "T1003" ] }, { "type": "malware", "id": "malware--27c4b30b-0ed1-50bc-b75d-84fc0630ab79", "name": "Amatera Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/pavinloader-abuses-msbuild-and-trojanized-net-dlls-in-multi-stag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1218" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" } ], "labels": [ "T1059", "T1218", "T1204", "T1140" ] }, { "type": "malware", "id": "malware--af63db8a-570d-5ad6-9c6f-66a124de3558", "name": "Amatera Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wordlistloader-hides-shellcode-in-plain-english-words-to-deliver/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1204", "T1059", "T1027", "T1055" ] }, { "type": "malware", "id": "malware--74107810-a78f-5347-895b-48c7a4e87dca", "name": "AmnesiaStealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/amnesiastealer-macos-malware-steals-data-controls-browser-sessio/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1566", "T1204", "T1059", "T1056", "T1185", "T1555" ] }, { "type": "malware", "id": "malware--8bde6306-9841-51d1-9de6-2a717d76a16b", "name": "Antino", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-04T00:00:00Z", "modified": "2026-10-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-talos-details-antino-backdoor-used-by-china-nexus-actor-ag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1566", "T1071", "T1567" ] }, { "type": "malware", "id": "malware--817bb1d6-b132-562c-bc23-486260a292d1", "name": "Anubis", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-affiliate-poses-as-recovery-firm-to-re-extort-victims/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1585" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" } ], "labels": [ "T1583", "T1585", "T1608", "T1199", "T1071", "T1102", "T1560", "T1041", "T1486", "T1490" ] }, { "type": "malware", "id": "malware--edab596b-6175-5ab3-ad16-1a8617afbab8", "name": "Anubis", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/beyond-the-ransomware-tracking-storm-2570-s-consistent-tradecraf/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "malware", "id": "malware--a704d7ef-16dd-54c4-ae0d-45ef61bf7803", "name": "AnyPwn", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/anypwn-anydesk-pre-auth-heap-buffer-overflow-rce-poc-published/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "malware", "id": "malware--1d512b81-56b7-52be-87c9-96e92924cfb7", "name": "AsyncRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blind-eagle-linked-loader-uses-github-vbscript-powershell-and-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1118" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" } ], "labels": [ "T1059", "T1086", "T1118", "T1204", "T1193" ] }, { "type": "malware", "id": "malware--c399c909-4f69-5306-ad8c-765644d4bb99", "name": "Atomic Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--e828d2c1-2f05-509c-b92f-2c780864f027", "name": "Atomic Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--013face0-3f1e-57f5-8bd3-b8cf32d1e2f5", "name": "Atomic macOS Stealer (AMOS)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/atomic-macos-amos-stealer-infection-campaign-observed/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1204", "T1036", "T1503" ] }, { "type": "malware", "id": "malware--55adfb80-bffe-5cef-acf4-bade723a4b95", "name": "Aurora ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/aurora-ransomware-affiliate-uses-cursor-ai-to-plan-attacks-again/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1558" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1021", "T1558", "T1071", "T1486" ] }, { "type": "malware", "id": "malware--b5248a18-5242-587c-bb1e-4a4a1fd89710", "name": "Babuk-derived ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-chinese-hackers-turn-vmware-vcenter-rce-into-root-back/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1053", "T1078", "T1486" ] }, { "type": "malware", "id": "malware--293d5f0c-6ff1-5122-82b4-ae74c6b2cc15", "name": "Balonx Android RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/balonx-phaas-steals-bank-otps-in-real-time-while-ai-calls-and-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1557", "T1539", "T1657" ] }, { "type": "malware", "id": "malware--5c26bd80-60c7-5e51-a097-6dd354aff2fc", "name": "Balonx Android RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/balonx-sistema-phaas-targets-20-mexican-banks-with-ai-vishing-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" } ], "labels": [ "T1566", "T1598", "T1571" ] }, { "type": "malware", "id": "malware--701284be-2da1-5318-975a-b9157d8e2075", "name": "BambooToken", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/inside-bambootoken-s-linux-implant-shell-and-file-control-over-m/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1059", "T1053" ] }, { "type": "malware", "id": "malware--be2f7a58-9dd1-50fe-a588-e5a620a584c8", "name": "BambooToken", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bambootoken-malware-uses-mqtt-to-control-windows-and-linux-syste/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1095" } ], "labels": [ "T1059", "T1071", "T1095" ] }, { "type": "malware", "id": "malware--837fd454-6094-56bf-a8e8-17ebcc7fd98e", "name": "Bandook", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dark-caracal-deploys-new-gocaracal-malware-with-ethereum-based-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1583", "T1105", "T1573", "T1005" ] }, { "type": "malware", "id": "malware--4356543f-ed60-5409-8169-69b57baf810e", "name": "BeaverTail", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "malware", "id": "malware--5f5ff020-415e-501f-8808-2135e3c54a9f", "name": "BeaverTail", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "malware", "id": "malware--830d9f68-5ead-5568-9804-f37331098972", "name": "BlackCat ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-has-a-new-target-is-your-backup-ready/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "malware", "id": "malware--4862b820-5304-504a-bfc3-f8689061e7b4", "name": "BlackMatter ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-has-a-new-target-is-your-backup-ready/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "malware", "id": "malware--b798b60e-5f4a-5e5f-92e1-7feaef30fca3", "name": "BloodAlchemy", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--f4f8467c-5ab3-5da4-9480-ac04ba04cf28", "name": "BloodHound", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--c6c8cbdf-053b-5029-903f-69b9b274371d", "name": "BlueMoon exploit kit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "malware", "id": "malware--ae4e7f6f-9560-53b6-9af1-a0a558afe3f4", "name": "Booba ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-disrupts-university-of-illinois-chicago-college-of-me/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1486", "T1005" ] }, { "type": "malware", "id": "malware--f6faf452-4990-5f44-99fc-4d0d14fa5d21", "name": "BraZetsu", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-brazetsu-malware-turns-compromised-corporate-pcs-into/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1059", "T1539", "T1005", "T1082" ] }, { "type": "malware", "id": "malware--e8a6b6bc-bf81-5ac9-aace-3ba0a7c48f9d", "name": "C2Looper v2", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/c2looper-v2-uses-github-repositories-as-full-command-and-control/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1102", "T1204", "T1059", "T1105" ] }, { "type": "malware", "id": "malware--44401b4b-122e-5341-83f6-e3c5eb2a466d", "name": "CARBONATO implant", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-an-open-source-ai-agent-into-a-tool-for-controlling/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1046" }, { "source_name": "MITRE ATT&CK", "external_id": "T1611" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1543" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1190", "T1046", "T1611", "T1053", "T1543", "T1102" ] }, { "type": "malware", "id": "malware--44b211e2-4542-5e10-9647-f8930934ef9c", "name": "CCProxy", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "malware", "id": "malware--02633e77-f05a-5069-a6fd-e8b94e1c8a22", "name": "CHOSEN BRICK", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iranian-state-linked-hackers-deploy-windows-malware-chosen-brick/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1656", "T1547", "T1562", "T1114", "T1071" ] }, { "type": "malware", "id": "malware--37b834c7-a86a-5df0-830a-600349f54a85", "name": "CHOSEN BRICK", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iranian-apt-uses-chosenbrick-windows-malware-for-espionage/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1204", "T1036" ] }, { "type": "malware", "id": "malware--2fe57f7f-5014-5ff2-825c-bc25990ab7d9", "name": "Carbonato", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/carbonato-malware-uses-ai-agents-to-hijack-exposed-docker-hosts/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1610" }, { "source_name": "MITRE ATT&CK", "external_id": "T1609" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1046" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1610", "T1609", "T1053", "T1046", "T1102", "T1572" ] }, { "type": "malware", "id": "malware--50462e3f-4e1f-55b5-9573-3b61f880854f", "name": "Certipy", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--c8e948d8-569b-5270-aa1a-76ee3cc5ea8f", "name": "ChainDrop", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chaindrop-npm-worm-hijacks-github-actions-oidc-to-poison-444-pac/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1528" ] }, { "type": "malware", "id": "malware--fedc6656-593d-567f-87de-3525ede1e01d", "name": "Chisel", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blinder-tunnel-campaign-targets-iraqi-infrastructure/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1059", "T1547", "T1105", "T1571", "T1090" ] }, { "type": "malware", "id": "malware--48939852-8f78-55ea-aede-c097ed95c465", "name": "ChocoShell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1669", "T1659", "T1557", "T1621", "T1548", "T1185" ] }, { "type": "malware", "id": "malware--6ffdc311-42fd-57b4-ba2f-32e5c10bace2", "name": "ClickFix variant", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-use-fake-cloudflare-captcha-to-deploy-terminalfix-revers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1059", "T1204", "T1574", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--b79bfaf2-42a6-5610-8695-cf3036e09cc5", "name": "Cling", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cling-botnet-exploits-stun-protocol-for-iot-command-and-control/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" } ], "labels": [ "T1190", "T1071", "T1572", "T1547", "T1036", "T1498" ] }, { "type": "malware", "id": "malware--a9b5d9e4-aa59-548a-a431-6f421d02d424", "name": "ClingSTUN", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1543" } ], "labels": [ "T1190", "T1071", "T1090", "T1543" ] }, { "type": "malware", "id": "malware--74e96b8f-f5c8-5a7e-9f1b-f953f889a1f0", "name": "ClosedQuorum", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-closedquorum-windows-malware-uses-ai-for-attack-decisions/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1059", "T1053", "T1003", "T1055" ] }, { "type": "malware", "id": "malware--af5bfa84-9826-51f4-8eec-f5a5e5e711de", "name": "CloudSyncD", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-04T00:00:00Z", "modified": "2026-10-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/macos-users-targeted-by-fake-zoom-installer-carrying-cloudsyncd/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1036", "T1204", "T1548" ] }, { "type": "malware", "id": "malware--751ae614-5da4-5588-8f39-82300e0a8980", "name": "Contagious Interview npm malware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "malware", "id": "malware--9bc429ea-9c2e-595e-b9f2-a8a39526a54a", "name": "CookiETagRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--afe65140-6cf9-507f-bee6-6b360556e4a7", "name": "CoolClient", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kern/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1014", "T1055", "T1140", "T1027" ] }, { "type": "malware", "id": "malware--9b0f55c0-d1f9-5344-a5d7-402e164281a9", "name": "CoreRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-26T00:00:00Z", "modified": "2026-08-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/core-werewolf-hackers-deploy-new-corerat-malware-against-russian/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" } ], "labels": [ "T1566", "T1204", "T1059", "T1082", "T1005", "T1070" ] }, { "type": "malware", "id": "malware--028e22fe-bbfa-5663-90c1-766ad013f547", "name": "CornFlake", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1669", "T1659", "T1557", "T1621", "T1548", "T1185" ] }, { "type": "malware", "id": "malware--cea0962b-f6f5-507a-8d32-abdac74699de", "name": "CosmicPulse", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105" ] }, { "type": "malware", "id": "malware--e52a0ffb-f69f-572c-9dff-83d44c3bf32c", "name": "CosmicPulse", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/star-blizzard-refines-phishing-and-malware-delivery-with-the-red/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1204", "T1053" ] }, { "type": "malware", "id": "malware--c8f6ba0d-28cb-5f56-b25f-18075df4c13f", "name": "Custom Java web shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/clop-created-custom-web-shell-for-windchill-data-theft-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1212" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1081" } ], "labels": [ "T1190", "T1100", "T1212", "T1005", "T1041", "T1081" ] }, { "type": "malware", "id": "malware--a0a1e4e4-a227-5213-ba9a-bde14b82335f", "name": "Cyclops Blink", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "malware", "id": "malware--a8f8b986-5105-55a7-a946-f1342090573d", "name": "Cyclops Blink", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-management-plane-is-the-attack-surface-what-cisco-fmc-s-expl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1190", "T1100", "T1059", "T1133" ] }, { "type": "malware", "id": "malware--dd0f959a-cc45-52cd-8707-8eb5627ad443", "name": "Cyclops Blink", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "malware", "id": "malware--a5af31ef-96c9-51ef-9c68-bf892aa0c5fd", "name": "DC.exe", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-aa26-281a-advisory-chinese-government-linked-actors-with-fb/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1189", "T1110", "T1036", "T1547", "T1114", "T1003" ] }, { "type": "malware", "id": "malware--8a7e1f42-498c-5616-a26b-06c24c03620f", "name": "DCRat (DarkCrystal RAT)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-15T00:00:00Z", "modified": "2026-08-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malicious-svg-reconstructs-dcrat-archive-entirely-inside-victim/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1566", "T1027", "T1574", "T1055" ] }, { "type": "malware", "id": "malware--59436862-0b98-5ce6-b779-818d06466a68", "name": "DEV#POPPER.js", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1566", "T1071", "T1105", "T1059" ] }, { "type": "malware", "id": "malware--725f262f-adc1-52c6-9b23-d0fe5fde87d0", "name": "DarkVNC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-charges-russian-for-infecting-80-000-freelancers-with-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1566", "T1204", "T1219" ] }, { "type": "malware", "id": "malware--bd7d0a58-9d21-5332-87e3-be7cc9766301", "name": "DeadLock", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1489", "T1548" ] }, { "type": "malware", "id": "malware--c0c5fb35-1ed7-5acf-a759-345ba4c05165", "name": "DeadLock", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1480" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1480" ] }, { "type": "malware", "id": "malware--bdc29f56-577d-55fb-95d6-f6ac904d9f22", "name": "DiagTrack.exe", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-aa26-281a-advisory-chinese-government-linked-actors-with-fb/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1189", "T1110", "T1036", "T1547", "T1114", "T1003" ] }, { "type": "malware", "id": "malware--cb7df078-7754-5764-b2a1-fda4b221447c", "name": "Dindoor", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-26T00:00:00Z", "modified": "2026-08-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/muddywater-linked-dindoor-backdoor-abuses-legitimate-deno-runtim/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1059", "T1105", "T1497", "T1082" ] }, { "type": "malware", "id": "malware--4ab3ed52-316d-5e0f-af8d-ad6566165221", "name": "DragonForce", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-affiliate-poses-as-recovery-firm-to-re-extort-victims/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1585" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" } ], "labels": [ "T1583", "T1585", "T1608", "T1199", "T1071", "T1102", "T1560", "T1041", "T1486", "T1490" ] }, { "type": "malware", "id": "malware--df3219dc-4b81-56b4-bdc2-9c8e3d46fe24", "name": "DragonForce", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/beyond-the-ransomware-tracking-storm-2570-s-consistent-tradecraf/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "malware", "id": "malware--a687214f-871c-5a4b-9078-27edc55fd24f", "name": "DriveSilkRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--4b87e6f5-2947-5dc2-94ed-d8ddb89a9d1d", "name": "Dysphoria", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-15T00:00:00Z", "modified": "2026-08-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dysphoria-hijacks-routers-gateways-and-ip-cameras-to-build-massi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" } ], "labels": [ "T1090", "T1498" ] }, { "type": "malware", "id": "malware--a247753a-0221-5041-9523-7b25382a0aae", "name": "EBurst", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-aa26-281a-advisory-chinese-government-linked-actors-with-fb/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1189", "T1110", "T1036", "T1547", "T1114", "T1003" ] }, { "type": "malware", "id": "malware--70e70618-4b6f-53f1-8c82-b1c580b5cabc", "name": "EggJagger", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1583", "T1071", "T1486" ] }, { "type": "malware", "id": "malware--e8804965-3451-594c-8f64-237d975da468", "name": "EncForge", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/jadepuffer-agentic-ransomware-first-documented-ai-agent-driven-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" }, { "source_name": "MITRE ATT&CK", "external_id": "T1530" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1053", "T1136", "T1530", "T1486", "T1059" ] }, { "type": "malware", "id": "malware--118cb53b-1e7f-500a-966a-61070fbb6f77", "name": "EvilTokens", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/eviltokens-abuses-microsoft-device-codes-to-hijack-accounts-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1621", "T1078" ] }, { "type": "malware", "id": "malware--26e920c8-012e-5e69-b0ea-b8e7b2d3df6c", "name": "EvilTokens", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1621", "T1528", "T1098", "T1114", "T1657" ] }, { "type": "malware", "id": "malware--d9a2b1fc-d19a-55e3-a960-b79810915a9e", "name": "EvilTokens", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" } ], "labels": [ "T1566", "T1621", "T1539", "T1098" ] }, { "type": "malware", "id": "malware--95832115-a7b7-5dbf-af7d-91baa7d30c0b", "name": "Evilginx", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "malware", "id": "malware--697f85be-b408-570b-9717-3d109b3a72d6", "name": "Evilginx2", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-2-0-phishing-service-bypasses-mfa-in-global-m365-campaig/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1557", "T1539", "T1621", "T1071", "T1090" ] }, { "type": "malware", "id": "malware--bc452974-bf05-5768-ada6-debe7c50fdcc", "name": "Evilginx2 (rebranded as BigBear 2.0)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organ/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" } ], "labels": [ "T1557", "T1539", "T1566", "T1111" ] }, { "type": "malware", "id": "malware--bd77f5ec-3c85-5c2c-ba73-24f42f86aeb6", "name": "Exodus RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malicious-exodus-installer-steals-browser-credentials-and-turns/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1195", "T1204", "T1059", "T1055", "T1539", "T1090" ] }, { "type": "malware", "id": "malware--969707df-16c9-55c7-a470-271f8827f741", "name": "FLATROOF", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "malware", "id": "malware--c868be10-24f7-57af-85e4-2ba8a537f6ff", "name": "FLATROOF", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-tradertraitor-group-uses-trojanized-terraform-provider/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1195", "T1059", "T1105", "T1005" ] }, { "type": "malware", "id": "malware--e02d89c6-c8ef-5023-89f2-cdfb08213330", "name": "FalconFlank", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/crowdstrike-falconflank-zero-day-grants-system-privileges/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1060" } ], "labels": [ "T1068", "T1548", "T1053", "T1060" ] }, { "type": "malware", "id": "malware--64b11f27-c284-568c-8565-adadcbd60680", "name": "Fast Labyrinth", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "malware", "id": "malware--f5debbc3-bc89-5753-8256-5bb66ce12b0c", "name": "FishHub", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/doj-fbi-seize-flax-typhoon-linked-hacking-tools-microscan-fishhu/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1595", "T1566", "T1110", "T1133" ] }, { "type": "malware", "id": "malware--7693e8fd-a6ad-5ace-adab-3fb6a5b8df8d", "name": "FortigateSniffer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/alert-fortibleed-remains-active-campaign-can-lock-out-users-or-l/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1040" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" } ], "labels": [ "T1190", "T1110", "T1078", "T1040", "T1098", "T1070" ] }, { "type": "malware", "id": "malware--a553286d-0c10-573a-8145-b49934b7b83e", "name": "FudModule", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "malware", "id": "malware--fac1b91a-7f08-5385-af8d-b0606417298a", "name": "GRAYRABBIT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1204", "T1059", "T1027" ] }, { "type": "malware", "id": "malware--f13244c8-6199-56f7-a3ba-34cc54ded064", "name": "GRIMWEDGE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "malware", "id": "malware--d639e48b-ae43-5e03-a076-8a67241ab35a", "name": "GenieLocker", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "malware", "id": "malware--ec1f82f4-e0d9-5548-8f20-337a77cf789e", "name": "Gentlemen ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/gentlemen-ransomware-affiliate-uses-mcp-as-c2-channel-in-live-cy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1595", "T1059", "T1078", "T1552", "T1071" ] }, { "type": "malware", "id": "malware--62292bab-fe98-54fd-94cc-552ee8fcd02f", "name": "GhostContainer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/nighteagle-targets-russian-companies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1078", "T1133", "T1210", "T1059", "T1572" ] }, { "type": "malware", "id": "malware--7ae66058-38d2-593b-83b8-69194df3bb32", "name": "Gigabud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/android-banking-trojan-gigaplay-vwork-exploits-work-profiles-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1059", "T1082" ] }, { "type": "malware", "id": "malware--c5a03ba4-2d40-58a6-a9ef-519498428b38", "name": "Gigabud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-gigabud-banking-trojan-pairs-with-vwork-to-clone-bank-apps-i/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" } ], "labels": [ "T1566" ] }, { "type": "malware", "id": "malware--8ec3015f-123f-5dea-b595-88dd90478d9d", "name": "GlassWorm loader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/glassworm-supply-chain-attack-hides-malware-inside-vs-code-color/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1176", "T1059" ] }, { "type": "malware", "id": "malware--23ff223a-166f-502e-a857-1d829b5eca36", "name": "Glassworm botnet", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/glassworm-botnet-disrupted-crowdstrike-google-and-shadowserver-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1176", "T1552", "T1102" ] }, { "type": "malware", "id": "malware--90743cb1-fc15-5679-aa0c-c5125df3e692", "name": "GlasswormRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/glassworm-botnet-disrupted-crowdstrike-google-and-shadowserver-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1176", "T1552", "T1102" ] }, { "type": "malware", "id": "malware--e4d989e7-e33b-5e36-89ba-cd0d5f0669cd", "name": "GoCaracal", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dark-caracal-deploys-new-gocaracal-malware-with-ethereum-based-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1583", "T1105", "T1573", "T1005" ] }, { "type": "malware", "id": "malware--0a731824-d66d-5684-ab69-d890f12e24ee", "name": "Godzilla web shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/vulnerability-attack-case-installation-of-a-web-shell-and-execut/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1190", "T1100", "T1059", "T1068", "T1082", "T1102" ] }, { "type": "malware", "id": "malware--f669384c-a40b-5f63-ad9b-c87cc7f2fc6f", "name": "GoginRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--9efeb27a-1caa-5bae-b861-7031fdd40f27", "name": "Grandoreiro", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotligh/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" } ], "labels": [ "T1056", "T1557", "T1571" ] }, { "type": "malware", "id": "malware--3971d777-8e6a-580a-bcf2-753cf3f8fb3f", "name": "Graphalgo", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/graphalgo-malware-hits-terraform-and-go-packages-in-new-supply-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1497", "T1102" ] }, { "type": "malware", "id": "malware--d1faf27d-65b6-584e-982e-7d5ad628f710", "name": "GrayRabbit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1190", "T1059", "T1203", "T1038", "T1573" ] }, { "type": "malware", "id": "malware--99446497-ed76-5179-b625-a263199b8bab", "name": "GreenDispenser", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--d120f6a6-444b-57e0-bc49-9cf00bf6a344", "name": "Gryxa", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/gryxa-toolkit-uses-ai-built-persistence-to-fight-back-against-se/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1084" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1053", "T1084", "T1547", "T1003", "T1562", "T1505" ] }, { "type": "malware", "id": "malware--61c27dbd-e21d-5b18-b995-c274941c0f35", "name": "GuardBreaker", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-aligned-uac-0099-weaponized-ai-safety-guardrails-with-gua/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1059", "T1684", "T1027" ] }, { "type": "malware", "id": "malware--2881eed3-64c9-541d-9fff-7e283eb670a2", "name": "Gunra", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1078", "T1486", "T1490", "T1567" ] }, { "type": "malware", "id": "malware--c4e93b3c-20ff-5f69-aecd-c597247e519d", "name": "Gunra", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-urges-organizations-to-patch-exposed-vpns-and-segment-netwo/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1078", "T1021", "T1486" ] }, { "type": "malware", "id": "malware--e131b35e-9013-56b1-b37f-b9cd2319dcf2", "name": "HACKERAI", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1566", "T1204", "T1071", "T1505" ] }, { "type": "malware", "id": "malware--4e805b13-b3b9-5e10-9c5f-19befaa76a1e", "name": "HEADLACE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "malware", "id": "malware--49758690-4ce1-553d-9846-5e74387e7fe2", "name": "HOOKEDGE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "malware", "id": "malware--ee67f790-ee83-56e6-a62f-057b2414392e", "name": "HOOKEDGE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "malware", "id": "malware--98879c80-35f2-5cc9-88fb-06ac4cec54d6", "name": "HardBreacher", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hardbreacher-exploit-targets-kaspersky-endpoint-security-zero-da/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" } ], "labels": [ "T1068" ] }, { "type": "malware", "id": "malware--2274deb4-c129-5c80-9bdc-56c50136cd48", "name": "JITTERLY rootkit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/red-heron-hackers-exploit-critical-gitea-rce-to-steal-source-cod/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" } ], "labels": [ "T1190", "T1100", "T1014" ] }, { "type": "malware", "id": "malware--3df96ae0-1bec-5ce9-a678-1d2233c9189f", "name": "JOMANGY", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1190", "T1100", "T1053", "T1037", "T1562" ] }, { "type": "malware", "id": "malware--503c820b-ccdb-590a-93ad-3581cd84dc4c", "name": "JSP web shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "malware", "id": "malware--655de88d-3481-5995-91d6-2fc87f638226", "name": "JSP web shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "malware", "id": "malware--104891ee-b735-53c3-a077-2cc54978f4c7", "name": "JWR PhaaS framework", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/jwr-phishing-as-a-service-kit-uses-websockets-and-aes-to-run-rea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1557", "T1056", "T1071" ] }, { "type": "malware", "id": "malware--c31c3d8b-c11c-5645-b894-60aa0c0cd419", "name": "JarService", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-infect-android-car-head-units-with-proxy-botnet-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1505", "T1027", "T1041" ] }, { "type": "malware", "id": "malware--344b5d7b-f6a5-5cdf-be9f-d578ad617215", "name": "KNUCKLEBALL", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "malware", "id": "malware--49246fd5-bb0f-53fa-8539-ef8c1d29ef1a", "name": "KREMLIN banking malware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kremlin-malware-installs-chrome-extensions-users-never-approved/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1176", "T1539", "T1059" ] }, { "type": "malware", "id": "malware--4b30a165-54a3-504c-978d-13ac7b3dca96", "name": "KREMLIN banking malware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credent/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1176", "T1557", "T1539", "T1555" ] }, { "type": "malware", "id": "malware--52e93883-f298-527d-b0e3-6ec109707ea9", "name": "KillSec ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/killsec-ransomware-group-disrupted-in-international-law-enforcem/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1530" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1190", "T1530", "T1486", "T1490", "T1567", "T1090" ] }, { "type": "malware", "id": "malware--d12654b6-2f3e-50e5-abcc-859fb96d411f", "name": "Kimwolf", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimwolf-botnet-rebuilt-to-survive-takedowns-researchers-say/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1498" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1568" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1498", "T1071", "T1568", "T1573", "T1036", "T1090" ] }, { "type": "malware", "id": "malware--913512bd-9833-544d-b30b-3e036c636ec2", "name": "LONGTALE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "malware", "id": "malware--4e7320bc-84c1-5296-9d2f-8fcd90490cb0", "name": "LUNARAXE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/lunexstealer-gives-hackers-remote-control-of-browsers-through-ma/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1204", "T1176", "T1539" ] }, { "type": "malware", "id": "malware--3baa2dc5-25b3-5bbe-8d67-32cbe183cd1b", "name": "LUNEXSTEALER", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/lunexstealer-gives-hackers-remote-control-of-browsers-through-ma/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1204", "T1176", "T1539" ] }, { "type": "malware", "id": "malware--97adb94a-6161-539a-a5c8-501a822d982e", "name": "Ligolo-ng", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--0021be4f-d3d4-5d61-b2fe-6d6e7682a975", "name": "LostKeys", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105" ] }, { "type": "malware", "id": "malware--02e37806-42f9-5b99-88d3-4a32650d8cdd", "name": "Lumma", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealers-are-stealing-cloud-and-ai-credentials-from-infected/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1552", "T1539" ] }, { "type": "malware", "id": "malware--bac710e3-282f-5d89-b5ad-e953b3271b7b", "name": "Lumma", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--22addea4-a1d8-5241-b794-82aef2faa467", "name": "LummaC2", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--d974f470-1733-54d2-993f-1cc83ed1a95a", "name": "LunarAxe", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cert-ua-100-websites-compromised-to-spread-lunex-stealer-via-fak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1189", "T1674", "T1059", "T1555", "T1539" ] }, { "type": "malware", "id": "malware--2cc78aa1-104a-5e8e-9cac-2b2ccac29e1a", "name": "Lunex", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/psychedelic-stealer-spread-via-fake-captcha-prompts-on-ukrainian/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1659", "T1204", "T1059", "T1548", "T1014", "T1053" ] }, { "type": "malware", "id": "malware--3b7997f6-c879-5696-870d-0b6cbdd04e3d", "name": "Lunex Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cert-ua-100-websites-compromised-to-spread-lunex-stealer-via-fak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1189", "T1674", "T1059", "T1555", "T1539" ] }, { "type": "malware", "id": "malware--aa0306cc-9981-5a05-bf1b-d54a36fe4e17", "name": "MATCHBOIL", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/evolution-of-matchboil-downloader-by-uac-0099/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" } ], "labels": [ "T1193", "T1105", "T1027", "T1497" ] }, { "type": "malware", "id": "malware--974f8b79-9871-5a41-b4ae-747d60ecf5b3", "name": "MISTPEN", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "malware", "id": "malware--0af3f5bc-e948-54db-8572-76d3be061ff0", "name": "MacSync", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-claude-install-guide-steals-mac-passwords-and-turns-trusted/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1027", "T1555", "T1041" ] }, { "type": "malware", "id": "malware--9a220dab-4090-51db-a62a-03d748b04eb6", "name": "MacSync", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1159" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" } ], "labels": [ "T1204", "T1059", "T1102", "T1159", "T1037" ] }, { "type": "malware", "id": "malware--f44356eb-0838-5e6c-b3b0-f2fa2a4913f8", "name": "MacSync Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/microsoft-links-30-domains-to-macsync-stealer-s-credential-theft/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1555", "T1185", "T1041" ] }, { "type": "malware", "id": "malware--d0cae1f1-941a-57cc-873f-e1c5f7327b6d", "name": "MacSync stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/macsync-the-evasive-macos-stealer-exploiting-clickfix-lures/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1204", "T1059", "T1555" ] }, { "type": "malware", "id": "malware--af98bfee-1b5c-5430-810e-c4577616fd32", "name": "Manic", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/manic-android-malware-family-targets-169-apps-with-banking-fraud/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1674", "T1056", "T1669", "T1005", "T1567" ] }, { "type": "malware", "id": "malware--cf2342cb-1584-5065-89a6-6a50290b562c", "name": "Manic", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/manic-android-malware-can-exfiltrate-data-through-nearby-devices/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1056", "T1005", "T1041" ] }, { "type": "malware", "id": "malware--f97433c3-994c-55b5-a77a-3ec605d20242", "name": "Manic", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotligh/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" } ], "labels": [ "T1056", "T1557", "T1571" ] }, { "type": "malware", "id": "malware--35f9f78d-860d-5159-9a5d-d5eddac6796b", "name": "Mantax OTAX", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mantax-otax-combines-android-ransomware-and-spyware-for-double-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1204", "T1059", "T1486" ] }, { "type": "malware", "id": "malware--67138a4d-dd6f-5864-87c9-da77530ee8ef", "name": "Mantax Otax", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mantax-otax-android-malware-combines-ransomware-spyware-and-remo/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1486", "T1113", "T1056", "T1567", "T1071" ] }, { "type": "malware", "id": "malware--41ebc643-2271-5f0c-aa39-1c0e2296c2de", "name": "Medusa ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/medusa-ransomware-tallies-hundreds-of-new-victims-says-updated-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1020" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1486", "T1020", "T1562", "T1059", "T1003", "T1021" ] }, { "type": "malware", "id": "malware--17c55c6d-66c7-5973-a8bd-71b190bbef80", "name": "Meterpreter", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-papercut-ng-mf-flaws-to-steal-credentials-and-de/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1059", "T1136", "T1003" ] }, { "type": "malware", "id": "malware--041bb9d3-b5f8-5dea-baae-25b9580c6722", "name": "Microscan", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/doj-fbi-seize-flax-typhoon-linked-hacking-tools-microscan-fishhu/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1595", "T1566", "T1110", "T1133" ] }, { "type": "malware", "id": "malware--41c71942-d9e7-5a5b-83a7-b56edc4aeae7", "name": "Midnight Mimosa", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/midnight-mimosa-preinstalled-android-malware-in-mediatek-firmwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1019" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1019", "T1071", "T1496", "T1036" ] }, { "type": "malware", "id": "malware--972cf0db-67cc-5395-810e-ac44da999891", "name": "Midnight Mimosa", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/midnight-mimosa-ad-fraud-malware-preinstalled-in-cheap-android-p/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1019" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1019", "T1105", "T1071", "T1090", "T1036", "T1496" ] }, { "type": "malware", "id": "malware--43c76335-e4e8-5f1f-a3eb-ed5750aa8f83", "name": "Mimikatz", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--68292b31-a976-5236-803c-e5ab469fa119", "name": "Mini Shai-Hulud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shai-hulud-trinitite-supply-chain-worm-hits-npm-package-with-150/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" } ], "labels": [ "T1195", "T1552", "T1677" ] }, { "type": "malware", "id": "malware--dca70bae-d6ea-5e20-95fc-f6687c78a8b6", "name": "Mini Shai-Hulud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mini-shai-hulud-worm-re-infects-github-repositories-via-hijacked/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1195", "T1677", "T1528", "T1041", "T1485" ] }, { "type": "malware", "id": "malware--e4c441e0-f45a-5e0f-bb0b-5f1c78f00bbe", "name": "Mirai-like botnet", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cpanel-whm-critical-authentication-bypass-cve-2026-41940-cvss-9/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" } ], "labels": [ "T1190", "T1078", "T1110" ] }, { "type": "malware", "id": "malware--d60487e4-f864-5f04-a14c-0b93739af2da", "name": "MovieReaper", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-malware-in-movie-torrents-uses-solana-blockchain-for-c2-cont/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1204", "T1071" ] }, { "type": "malware", "id": "malware--be889ebd-c73c-56a7-b5b4-94f87566d834", "name": "NaiveMess", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cert-ua-100-websites-compromised-to-spread-lunex-stealer-via-fak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1189", "T1674", "T1059", "T1555", "T1539" ] }, { "type": "malware", "id": "malware--f4e8ad05-b9e7-5520-963d-91f3ced9a232", "name": "NeedyMantis", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/needymantis-unpacking-a-post-compromise-malware-family-used-in-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1570" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1195", "T1073", "T1570", "T1071" ] }, { "type": "malware", "id": "malware--02c84b5c-aa60-5088-9f41-f6e149a921b5", "name": "Neo-reGeorg", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/nighteagle-targets-russian-companies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1078", "T1133", "T1210", "T1059", "T1572" ] }, { "type": "malware", "id": "malware--fa472adf-8042-5f8a-a674-911be2c2f572", "name": "Neo-reGeorg", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-hackers-say-they-won-t-publish-massive-trove-of-fbi-employee/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1505", "T1116", "T1572", "T1219" ] }, { "type": "malware", "id": "malware--ca124805-c228-5180-a27b-024208467dea", "name": "NetExec", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--d65f8608-d4a0-57aa-b5fc-a86ac6306960", "name": "NetSupport RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-chatgpt-shared-links-and-fake-cloudflare-captcha-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1566", "T1059", "T1219" ] }, { "type": "malware", "id": "malware--5d8843df-b313-504b-bd91-48a83b6e2286", "name": "Netch", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "malware", "id": "malware--75190808-fa9e-5e26-abd3-f377a5d1fbaa", "name": "NightSpire ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "malware", "id": "malware--e88c1347-4bdf-5a78-ad23-0b84da0a63da", "name": "Node.js implant", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/impersonating-it-support-how-threat-actors-turn-a-remote-session/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1534" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1534", "T1219", "T1021", "T1059", "T1082", "T1113" ] }, { "type": "malware", "id": "malware--85304353-23d5-5229-b448-6b780231af70", "name": "NodeEdgeRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--7881706c-78fc-5494-8608-f6175911b7d7", "name": "NomadRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--07cbef89-7a55-5fbe-98dd-a6cb742fbd6c", "name": "NovaStealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/openclaw-novastealer-attacks-target-60-crypto-wallets-ssh-keys-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1566", "T1005", "T1555", "T1041" ] }, { "type": "malware", "id": "malware--945f86b0-b718-540c-b144-7f61faa69486", "name": "ORANGETAIL", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "malware", "id": "malware--db3fb88e-487b-548f-acd4-0eb0dc429e19", "name": "Octagon", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/octagon-android-bot-targets-crypto-wallets-and-banking-apps-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1082", "T1056", "T1573", "T1113" ] }, { "type": "malware", "id": "malware--48c003db-c4d5-5a5b-a832-f63daab0f87d", "name": "OmniStealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1566", "T1071", "T1105", "T1059" ] }, { "type": "malware", "id": "malware--78265887-44d1-5161-8399-f5142192ba25", "name": "OpenSUpdater", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/opensupdater-malware-hides-reflective-loader-inside-recompiled-7/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1620" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1036", "T1116", "T1620", "T1105" ] }, { "type": "malware", "id": "malware--781d474f-0498-5612-a1d4-fbaecabd87f8", "name": "Operation ASTERIX toolkit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/operation-asterix-uses-vishing-and-fake-crypto-wallet-apps-to-st/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1598", "T1566", "T1056", "T1102" ] }, { "type": "malware", "id": "malware--ab8ec870-f07e-5c9b-83cd-92bb03f89f05", "name": "OtterCookie", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-operators-move-beyond-git-hooks-with-trojan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1195", "T1204", "T1574", "T1547" ] }, { "type": "malware", "id": "malware--0774e8e5-281a-54c7-8499-d7b039d5ddd6", "name": "Overlord RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/long-running-npm-malware-campaign-accumulates-40-000-downloads/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1204", "T1059" ] }, { "type": "malware", "id": "malware--9a81751b-914b-543e-9a36-845184996f6f", "name": "Overlord RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malfex-eight-malicious-npm-packages-deliver-overlord-rat-40-767/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1204", "T1059" ] }, { "type": "malware", "id": "malware--e09e074e-75ef-5297-a9c1-35f216dca7c5", "name": "Overlord RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malfex-supply-chain-campaign-targets-npm-and-github/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1195", "T1059", "T1503" ] }, { "type": "malware", "id": "malware--f0c9adc3-27ad-5b8d-8426-69c29cbffcf0", "name": "P7 DarkSword", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/p7-darksword-ios-exploit-kit-adds-crypto-wallet-theft-and-remote/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1189", "T1555", "T1005", "T1071" ] }, { "type": "malware", "id": "malware--377f0c1a-6cee-579f-b668-72d97bc47989", "name": "PATCHCORD", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1566", "T1204", "T1071", "T1505" ] }, { "type": "malware", "id": "malware--1f8c6eba-b5f6-5afc-9d9d-99044fc42f4f", "name": "PAYLOAD ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/group-policy-hijacked-payload-ransomware-weaponizes-active-direc-9247/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1486", "T1053", "T1059" ] }, { "type": "malware", "id": "malware--b143066f-bbbe-5a5f-a53c-dd9a3ddf7d93", "name": "PEEP", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-can-use-peep-chrome-extension-to-steal-credentials-and-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1176", "T1059", "T1056", "T1539" ] }, { "type": "malware", "id": "malware--7d40f7ed-c6c1-5d3d-af54-65d60ee16511", "name": "PackClient RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-deploy-packclient-rat-via-tax-themed-phishing-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1059", "T1204", "T1053" ] }, { "type": "malware", "id": "malware--55ab17c0-17ed-5696-9022-e7de0acb3c00", "name": "PamStealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-pamstealer-macos-variant-adds-live-c2-payload-decryption-and/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" }, { "source_name": "MITRE ATT&CK", "external_id": "T1159" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1059", "T1037", "T1159", "T1573", "T1105" ] }, { "type": "malware", "id": "malware--b6d4d64f-7f83-5c7e-83b8-c229b5724747", "name": "Panzer ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-hits-16-victims-across-11-countries-with-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1567" ] }, { "type": "malware", "id": "malware--d9a187f0-ef0b-5ee7-97da-64eb92ab1dd0", "name": "Panzer ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-emerges-with-windows-linux-esxi-and-freebsd-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "malware", "id": "malware--ee0a6739-3331-5b07-a2d3-66003984527f", "name": "PasteSwitch clipboard hijacker", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/le-compte-reddit-de-hbo-max-a-pouss-des-malwares-pendant-48-heur/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1539" ] }, { "type": "malware", "id": "malware--4c303b8a-8d89-581f-9198-7db34a8372c5", "name": "PavinLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/pavinloader-abuses-msbuild-and-trojanized-net-dlls-in-multi-stag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1218" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" } ], "labels": [ "T1059", "T1218", "T1204", "T1140" ] }, { "type": "malware", "id": "malware--92673633-282c-5f0e-8bd7-2c9469a2deef", "name": "PhantomCore", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/trueconf-security-advisory-av26-835/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1190", "T1204", "T1059" ] }, { "type": "malware", "id": "malware--84d69d16-26ca-5fd1-a811-08309f43af2b", "name": "PivotC2", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fortigate-cve-2025-25249-now-delivering-pivotc2-rat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1059", "T1071", "T1571", "T1003" ] }, { "type": "malware", "id": "malware--9809e764-2d7f-511c-82aa-54bf168f3242", "name": "Ploutus", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--734f515a-7241-58cd-93c7-6f4db6c576d3", "name": "PoeLLM", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1190", "T1595", "T1102", "T1496" ] }, { "type": "malware", "id": "malware--bae25817-0ed3-5054-8776-6f2e50af3df5", "name": "Poper Blocker", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/poper-blocker-chrome-extension-exfiltrates-browsing-history/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1119" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1176", "T1113", "T1119", "T1567" ] }, { "type": "malware", "id": "malware--76d03496-9751-5695-b0a7-757f1ff6e463", "name": "Psychedelic Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/psychedelic-stealer-spread-via-fake-captcha-prompts-on-ukrainian/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1659", "T1204", "T1059", "T1548", "T1014", "T1053" ] }, { "type": "malware", "id": "malware--d1321a74-d983-537e-ba13-77543505c0f5", "name": "QScan", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "malware", "id": "malware--55217e63-07fd-5d00-a6ba-73391b4ff04f", "name": "QTProxy", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "malware", "id": "malware--1f7f9971-70cb-5c80-9ac1-83a0925f9d6b", "name": "QTRouter", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "malware", "id": "malware--3a7607a6-5b89-59cd-b55e-44919eced6e5", "name": "QUICAgent", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1204", "T1059", "T1573" ] }, { "type": "malware", "id": "malware--cb3958ca-361c-5782-a513-238888bd8601", "name": "QUICAgent", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-hackers-target-myanmar-diplomats-with-government-the/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1059", "T1005" ] }, { "type": "malware", "id": "malware--e766163e-6cbc-5182-a194-6777e9583830", "name": "Qilin", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/beyond-the-ransomware-tracking-storm-2570-s-consistent-tradecraf/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "malware", "id": "malware--19e1c24a-9cbc-51d7-b5db-d2346b1dbcaa", "name": "Qilin ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/touring-club-suisse-ransomware-claim-by-qilin/" } ], "labels": [] }, { "type": "malware", "id": "malware--5005ac30-01f9-586f-abe0-f8de85f20f89", "name": "Qilin ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "malware", "id": "malware--874a8bc6-684a-5901-a066-3a4f846bb6aa", "name": "Qilin ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/atf-investigating-major-cyber-incident-after-ransomware-group-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1490", "T1567" ] }, { "type": "malware", "id": "malware--dcdf84c1-3935-5a83-9518-58ede2720ef9", "name": "Qilin ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "malware", "id": "malware--b50849c0-766a-5afd-b293-974ee3df16b9", "name": "RATHat", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/rathat-android-banking-trojan-uses-gemini-ai-and-adb-shell-to-ta/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1566", "T1548", "T1056", "T1572" ] }, { "type": "malware", "id": "malware--f9bc4056-0aea-587f-b450-b4cbda974445", "name": "RAVEN (Reconnaissance & Attack on Vulnerable Elasticsearch Nodes)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/raven-tool-steals-entire-elasticsearch-databases-and-rebuilds-de/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1213" }, { "source_name": "MITRE ATT&CK", "external_id": "T1020" }, { "source_name": "MITRE ATT&CK", "external_id": "T1030" } ], "labels": [ "T1595", "T1190", "T1078", "T1505", "T1213", "T1020", "T1030" ] }, { "type": "malware", "id": "malware--0c413954-3b88-577c-afb6-512f0ed71d20", "name": "RIPPER", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--5e728544-b058-5fb9-9c09-c890425fd196", "name": "ROOFDECK", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "malware", "id": "malware--ccf0dc5c-255a-573d-b5f5-daf18cb392fc", "name": "ROOFDECK", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-tradertraitor-group-uses-trojanized-terraform-provider/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1195", "T1059", "T1105", "T1005" ] }, { "type": "malware", "id": "malware--768f2220-9bae-5501-95d8-e1fe66044ac9", "name": "ROOTRUN", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "malware", "id": "malware--ba1d9903-dda4-53d7-9df1-bda481c3e117", "name": "Radmin", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "malware", "id": "malware--d4986036-0337-5ed4-892f-ec98739888b9", "name": "Rapuncel", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-lastpass-authenticator-github-repos-push-new-rapuncel-infos/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1195", "T1574", "T1073", "T1562", "T1003" ] }, { "type": "malware", "id": "malware--37402395-0b4f-5472-8b33-57edcfccdf87", "name": "RatHat", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/rathat-lets-an-ai-assistant-read-your-phone-s-screen-and-tap-thr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1189", "T1059", "T1056", "T1111", "T1674", "T1071" ] }, { "type": "malware", "id": "malware--74c1c62e-3ecf-51f0-8624-1a666d09df7f", "name": "RatHat", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-rathat-android-trojan-steals-bank-credentials-pins-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" } ], "labels": [ "T1566", "T1204", "T1059", "T1674" ] }, { "type": "malware", "id": "malware--5a619ac1-ae77-5590-b6c3-2c009d580c1c", "name": "RedLine", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--81373cda-84ae-5b1a-8d44-2909d330db61", "name": "RedLine", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealers-are-stealing-cloud-and-ai-credentials-from-infected/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1552", "T1539" ] }, { "type": "malware", "id": "malware--f7d5bcec-30af-5776-965c-5e1585b131d8", "name": "RedLine", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--8d18b391-3793-50ba-9b91-e9145f2a9cb1", "name": "RelayShell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "malware", "id": "malware--2613d7f1-6fbf-53ad-8fb9-1030f0e8fbed", "name": "RemControl", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/remcontrol-android-malware-targets-european-and-canadian-users-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1015" } ], "labels": [ "T1583", "T1684", "T1015" ] }, { "type": "malware", "id": "malware--edd4b1b9-f94c-5953-8bf6-2f0fa1e15588", "name": "RemControl", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/remcontrol-android-banking-trojan-steals-pins-using-ai-built-phi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1056", "T1113", "T1562", "T1071" ] }, { "type": "malware", "id": "malware--7f38d6af-23a6-5b10-a6ef-866470bec92d", "name": "Remus", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/2cloader-a-new-malware-loader-delivering-vidar-and-remus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1497", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--2210f7a8-0a6c-5321-8cf1-aeaddc65e1b6", "name": "RevStealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-claude-opus-5-app-deploys-revstealer-to-steal-passwords-cry/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1036", "T1204", "T1539", "T1005" ] }, { "type": "malware", "id": "malware--91a4cfbc-3840-577a-84bb-9ad196abe0e0", "name": "Rubeus", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1059", "T1003", "T1082", "T1078" ] }, { "type": "malware", "id": "malware--6acb1c32-2715-5063-aa0f-6a38baa70e39", "name": "SETTRA ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/settra-ransomware-uses-meshagent-rmm-and-byovd-to-encrypt-window/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1219", "T1562", "T1059", "T1486" ] }, { "type": "malware", "id": "malware--0b7fe6cc-feb4-58fa-8bd3-92dacdb52142", "name": "SHEETCORD", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1566", "T1204", "T1071", "T1505" ] }, { "type": "malware", "id": "malware--64d57c0e-b633-5eec-a907-428db02bd42b", "name": "SIDEEYE", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-hackers-say-they-won-t-publish-massive-trove-of-fbi-employee/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1505", "T1116", "T1572", "T1219" ] }, { "type": "malware", "id": "malware--87ab6c0a-fbe1-5daa-971a-d275327dc0f6", "name": "SLEEPWALKER", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sleepwalker-backdoor-uses-smb-icmp-dns-and-vmware-vmci-for-cover/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1095" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1095", "T1071", "T1572", "T1036", "T1055" ] }, { "type": "malware", "id": "malware--07c488ad-f9e6-5abd-997e-a688515dc33b", "name": "SNOWLIGHT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/go-loader-uses-anti-sandbox-checks-and-snowlight-to-execute-file/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1620" } ], "labels": [ "T1566", "T1204", "T1059", "T1497", "T1620" ] }, { "type": "malware", "id": "malware--bb4eb910-cf3e-5d5d-8e7f-3e6e70871f07", "name": "SUCEFUL", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--74ef2af4-0345-5e42-9432-609fac2b3f9f", "name": "Sality", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1583", "T1071", "T1486" ] }, { "type": "malware", "id": "malware--008a0802-0b85-5f0c-8a01-745d35a4339d", "name": "ScreenConnect RAT (deployed via phishing)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/global-phishing-campaign-abuses-google-infrastructure-to-evade-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1102", "T1071" ] }, { "type": "malware", "id": "malware--1c0f912f-1d45-5634-a6f5-c344b5b355a8", "name": "SecFlow", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-speaking-hackers-use-claude-qwen-and-deepseek-ai-agents/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1595", "T1190", "T1105", "T1100", "T1059" ] }, { "type": "malware", "id": "malware--00ff81c0-ebf9-52e0-829a-a953d3f3a65f", "name": "SectopRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sectoprat-malware-hides-in-legitimate-software-to-steal-browser/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1106" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1053", "T1106", "T1574", "T1036", "T1503" ] }, { "type": "malware", "id": "malware--aaf7e7a5-93ab-5907-acc8-38cc2580a349", "name": "SecurityPDF", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "malware", "id": "malware--80926d20-009f-565f-87de-f346cbeb67a2", "name": "Settra", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-affiliate-poses-as-recovery-firm-to-re-extort-victims/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1585" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" } ], "labels": [ "T1583", "T1585", "T1608", "T1199", "T1071", "T1102", "T1560", "T1041", "T1486", "T1490" ] }, { "type": "malware", "id": "malware--31de498f-da58-5ab5-a0c5-5beb73f30baf", "name": "Shadow hVNC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shadow-hvnc-lets-hackers-operate-a-second-windows-desktop-invisi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1059", "T1113", "T1539", "T1185" ] }, { "type": "malware", "id": "malware--8bab173e-5cbb-5d3d-a2fe-60fbc83f9900", "name": "ShadowPad", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--9fde378e-fa2b-5246-8ec1-f9303666120e", "name": "Shai Hulud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-git/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1552", "T1567" ] }, { "type": "malware", "id": "malware--3ed8b01b-09ef-5939-ac0c-893f4bf2112b", "name": "Shai-Hulud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/two-alleged-teampcp-hackers-arrested-in-australia/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1078", "T1005", "T1041" ] }, { "type": "malware", "id": "malware--e7c0fa80-e552-5f68-a32c-f4e5333eadb9", "name": "Shai-Hulud", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/tensorlake-npm-package-compromised-to-deliver-shai-hulud-credent/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1552" ] }, { "type": "malware", "id": "malware--1b78d51f-ba16-5633-8d9c-55c90a36dd4b", "name": "Shai-Hulud npm worm", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/npm-supply-chain-worm-returns-after-four-month-dormancy-with-sam/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "malware", "id": "malware--64b6f17c-224f-5f02-b534-095fef913021", "name": "ShelbyLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blinder-tunnel-campaign-targets-iraqi-infrastructure/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1059", "T1547", "T1105", "T1571", "T1090" ] }, { "type": "malware", "id": "malware--ff581618-7a0a-59be-bbc1-190b661b9627", "name": "Silent XMR Miner", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/threat-actor-compiles-cryptominer-on-endpoint-via-samsung-magici/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1500" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1105", "T1136", "T1562", "T1500", "T1059" ] }, { "type": "malware", "id": "malware--4d6b90a2-1f83-53ee-868a-ac58af5c482a", "name": "Singularity Rootkit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/singularity-rootkit-bypasses-elastic-defend-ebpf-module-load-det/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1014", "T1562" ] }, { "type": "malware", "id": "malware--c534e1ae-ef51-5f83-a096-abdee632e5fc", "name": "Skimer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/five-venezuelans-plead-guilty-to-atm-jackpotting-attacks-in-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1200" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1200", "T1059", "T1657" ] }, { "type": "malware", "id": "malware--68c85b12-2dba-52c1-9bfb-7be4c894cf42", "name": "SloppyRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sloppyrat-malware-uses-clickfix-and-blockchain-c2-to-help-ransom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1204", "T1059", "T1021", "T1071" ] }, { "type": "malware", "id": "malware--596194dc-3d2e-5f50-bf4d-12ae6115cf36", "name": "SmartLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fakegit-campaign-7-600-malicious-github-repos-pushing-smartloade/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1608", "T1036", "T1204" ] }, { "type": "malware", "id": "malware--ecfb6a5c-3d07-5b04-b622-2edf6439e83c", "name": "SoftEther VPN", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "malware", "id": "malware--b82bc8f9-9d77-5122-b709-b99e953acb91", "name": "Sou5", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "malware", "id": "malware--3b7d1530-62d0-5130-ba41-314fbf4b30b1", "name": "SparroWocky", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-famoussparrow-is-targeting-government-organizations/" } ], "labels": [] }, { "type": "malware", "id": "malware--ac6f6d41-4c6f-54c4-804c-d91ed198f140", "name": "SparroWocky", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1190", "T1100", "T1059", "T1113" ] }, { "type": "malware", "id": "malware--060272af-0ce9-56d4-9523-8273e68132a1", "name": "SparrowDoor", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1190", "T1100", "T1059", "T1113" ] }, { "type": "malware", "id": "malware--025f2508-9a52-5ac3-a387-b3459e8b3631", "name": "SpiceRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--025eda3b-3e27-599b-b69b-50a6791e5662", "name": "StealC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--53a15732-a57c-5b06-8cba-859686d88420", "name": "StealC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fakegit-campaign-7-600-malicious-github-repos-pushing-smartloade/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1608", "T1036", "T1204" ] }, { "type": "malware", "id": "malware--fbec7a2f-aea7-592c-8bd6-96fa1475719a", "name": "StealC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--7cd26e0b-9771-5add-9f0e-764fe304ebf5", "name": "Storm ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-ransomware-lists-us-healthcare-provider-west-county-health/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "malware", "id": "malware--c12ef287-2b44-50d4-a7a8-8a5bf681b658", "name": "Storm ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-ransomware-strikes-gsac-auto-financing/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" } ], "labels": [ "T1486", "T1199" ] }, { "type": "malware", "id": "malware--75fc3c98-4d7b-5f2c-986c-57f8dd1eda17", "name": "StreamRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/streamrat-android-malware-abuses-accessibility-and-vnc-to-take-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1015" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1566", "T1015", "T1056", "T1113" ] }, { "type": "malware", "id": "malware--b91a0eae-1489-5262-ad1d-aad98e6a33a7", "name": "StyleSmuggler", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/adobe-security-advisory-av26-888/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" } ], "labels": [ "T1190", "T1100" ] }, { "type": "malware", "id": "malware--c3932754-d617-5d34-9a87-a6e54af17cb7", "name": "StyleSmuggler", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/adobe-releases-september-2026-patches-for-multiple-products-adob/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" } ], "labels": [ "T1190", "T1505", "T1100" ] }, { "type": "malware", "id": "malware--db61ad71-290c-5611-8901-af2d48fcd257", "name": "StyleSmuggler Rust backdoor", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/stylesmuggler-a-magento-zero-day-cve-2026-75650-delivering-a-rus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1190", "T1505", "T1100", "T1105" ] }, { "type": "malware", "id": "malware--c41a92ac-9113-587a-a44f-420b91400bff", "name": "SuperShell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1566", "T1204", "T1071", "T1505" ] }, { "type": "malware", "id": "malware--90931611-27be-5193-bce8-d07b688dfa0c", "name": "SweetPotato", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/vulnerability-attack-case-installation-of-a-web-shell-and-execut/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1190", "T1100", "T1059", "T1068", "T1082", "T1102" ] }, { "type": "malware", "id": "malware--3c51e276-5862-55cf-97c1-940fdffed3e7", "name": "SynkLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/synkloader-malware-spreads-through-microsoft-teams-phishing-and/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" } ], "labels": [ "T1566", "T1059", "T1053", "T1027", "T1036", "T1056" ] }, { "type": "malware", "id": "malware--12ccb215-aade-5feb-a78a-b4359efa5266", "name": "TASK#STOMP", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/task-stomp-powershell-backdoor-steals-business-documents-and-exe/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1099" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1059", "T1053", "T1547", "T1099", "T1005", "T1113" ] }, { "type": "malware", "id": "malware--52e13078-3181-5899-8d58-052ab5a6d053", "name": "TIKTOUK", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/tiktouk-wordpress-toolkit-could-enable-aws-smtp-and-api-credenti/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1119" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1595", "T1552", "T1555", "T1119", "T1071" ] }, { "type": "malware", "id": "malware--82e0c14b-d4ba-57e9-947a-2e2fc0fb3fac", "name": "TVRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-charges-russian-for-infecting-80-000-freelancers-with-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1566", "T1204", "T1219" ] }, { "type": "malware", "id": "malware--c51344c3-9c0f-5093-8b79-a97cd294b5a0", "name": "TerminalFix", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-use-fake-cloudflare-captcha-to-deploy-terminalfix-revers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1059", "T1204", "T1574", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--53b120a6-1b3a-52b6-b15b-24e26e089523", "name": "ToxicPanda 2.0", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/toxicpanda-2-0-steals-pins-from-140-banking-and-cryptocurrency-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1056", "T1059", "T1005" ] }, { "type": "malware", "id": "malware--aa0a2ce2-840e-5d61-b260-05aaf73cf4f9", "name": "ToxicPanda 2.0", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/banking-trojans-manic-grandoreiro-toxicpanda-2-0-in-the-spotligh/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" } ], "labels": [ "T1056", "T1557", "T1571" ] }, { "type": "malware", "id": "malware--9df59066-1007-586a-8bd6-bd45017e7650", "name": "Trinitite", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shai-hulud-trinitite-supply-chain-worm-hits-npm-package-with-150/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" } ], "labels": [ "T1195", "T1552", "T1677" ] }, { "type": "malware", "id": "malware--0d0cd05d-d5a1-595f-b539-df2536554157", "name": "Trinitite supply-chain worm", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-tanstack-query-npm-package-to-steal-developer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "malware", "id": "malware--d023f161-fe54-5249-8aa5-a18066722eb3", "name": "Troy", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "malware", "id": "malware--2f2a5dd8-3f1a-5205-b6a2-cb5d151ca619", "name": "TukTuk C2", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-hackers-built-their-own-c2-framework-to-steal-passwor/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1583", "T1219" ] }, { "type": "malware", "id": "malware--187c75a9-b42b-56cc-8973-f7fe97568e69", "name": "UltraVNC", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "malware", "id": "malware--2244cf27-bf24-5a83-864d-8bb613fcbd4d", "name": "VShell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/go-loader-uses-anti-sandbox-checks-and-snowlight-to-execute-file/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1620" } ], "labels": [ "T1566", "T1204", "T1059", "T1497", "T1620" ] }, { "type": "malware", "id": "malware--0a636571-be82-58f7-bdaf-2fe1ac129787", "name": "VWork", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/android-banking-trojan-gigaplay-vwork-exploits-work-profiles-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1059", "T1082" ] }, { "type": "malware", "id": "malware--007322f3-273c-5e91-8197-91c345516495", "name": "VelvetCake", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/konni-hackers-target-ukraine-with-malicious-lnk-files-and-velvet/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" } ], "labels": [ "T1193", "T1204", "T1053", "T1086", "T1608" ] }, { "type": "malware", "id": "malware--196f58db-4a76-55ca-a6e3-98c1484014ca", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/vidar-adds-virtual-machine-and-custom-stream-ciphers-for-string/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1027", "T1059", "T1005" ] }, { "type": "malware", "id": "malware--39a45a80-795e-508f-bfdf-846e29fffc68", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-gta-6-demo-sites-spread-vidar-stealer-to-hijack-authenticat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1566", "T1204", "T1555" ] }, { "type": "malware", "id": "malware--3ac2e547-4ecb-56af-9c26-d2633a1a9d66", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/2cloader-a-new-malware-loader-delivering-vidar-and-remus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1497", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--428989dc-4b32-5e0d-ad99-26e9d76fb6d7", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealers-are-stealing-cloud-and-ai-credentials-from-infected/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1552", "T1539" ] }, { "type": "malware", "id": "malware--6dbe2c01-7be3-545a-8334-cf14b6c5b013", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fake-google-gemini-installer-distributes-vidar-stealer-via-googl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1503", "T1041" ] }, { "type": "malware", "id": "malware--aab1fbb8-ec90-53da-8c09-06b46e7c6717", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-logs-expose-replayable-ai-session-tokens-lumma-steal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1528", "T1539", "T1552", "T1657" ] }, { "type": "malware", "id": "malware--ec43c926-54a3-57a2-b0df-a5c8baf211b1", "name": "Vidar", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealer-malware-steals-claude-session-cookies-to-hijack-acco/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1539", "T1555", "T1038", "T1193", "T1059" ] }, { "type": "malware", "id": "malware--0469d824-b80c-5915-a5ab-edd79352ea70", "name": "Vwork", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-gigabud-banking-trojan-pairs-with-vwork-to-clone-bank-apps-i/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" } ], "labels": [ "T1566" ] }, { "type": "malware", "id": "malware--33f14149-6e45-5e0c-8454-c9e973e77cf6", "name": "Warden Stealer", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/infostealers-are-actively-hunting-ai-agents-and-developer-keys-w/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1119" }, { "source_name": "MITRE ATT&CK", "external_id": "T1024" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1552", "T1528", "T1119", "T1024", "T1027" ] }, { "type": "malware", "id": "malware--3c34be58-5e7e-508a-939c-c3502094cf44", "name": "Warlock ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1089" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1100", "T1089", "T1486" ] }, { "type": "malware", "id": "malware--af199e7a-8de0-56ae-b77b-67f80f160ff7", "name": "Warlock ransomware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-exploits-sharepoint-vulnerabilities-targeting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1486" ] }, { "type": "malware", "id": "malware--e28d344b-edc8-58c2-9b6d-117f794f6096", "name": "WeWorm", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wechat-zero-click-worm-took-over-accounts-on-iphone-and-android/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1091" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" } ], "labels": [ "T1189", "T1091", "T1098" ] }, { "type": "malware", "id": "malware--00b080aa-d34c-53d1-98e5-675a77079d20", "name": "WeaselBiscuit", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "malware", "id": "malware--b08d4b70-7cc9-5bc5-ac1d-dece4cf8c771", "name": "WeedHack", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/weedhack-malware-spreads-through-seo-poisoned-minecraft-sites-de/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1593" } ], "labels": [ "T1566", "T1204", "T1593" ] }, { "type": "malware", "id": "malware--aae82f3f-4e69-55e7-8b18-e7d9b9cf6db7", "name": "WordlistLoader", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wordlistloader-hides-shellcode-in-plain-english-words-to-deliver/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1204", "T1059", "T1027", "T1055" ] }, { "type": "malware", "id": "malware--d348d199-2e83-5c42-9f9b-83c83a906488", "name": "XCTDH", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korea-linked-malware-abuses-ethereum-transactions-as-cover/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1195", "T1071" ] }, { "type": "malware", "id": "malware--1b019bd5-5afd-5967-8452-026b3135c32c", "name": "XMRig", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/redis-cryptomining-botnet-compromised-3-562-servers-exposed-by-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1190", "T1053", "T1496" ] }, { "type": "malware", "id": "malware--813f666c-b558-509b-80b6-46b0ecb29acc", "name": "XMRig", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/powershell-malware-abuses-registry-and-dns-txt-records-to-deploy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1112" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1059", "T1086", "T1112", "T1071", "T1027" ] }, { "type": "malware", "id": "malware--bc3e5951-01d8-54cf-9a29-33da89c4b2df", "name": "XWorm RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/2cloader-a-new-malware-loader-delivering-vidar-and-remus/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1497", "T1027", "T1105" ] }, { "type": "malware", "id": "malware--8ce956c0-e051-54f7-bd5e-99a91c08f158", "name": "XZ Utils backdoor", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/die-xz-backdoor-ein-albtraum-der-die-open-source-welt-wachr-ttel/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" } ], "labels": [ "T1195" ] }, { "type": "malware", "id": "malware--7a59b813-d5f7-5eeb-9e2d-1ecc594caf6d", "name": "XenoRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asec-june-2026-apt-attack-report-south-korea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1566", "T1204", "T1059", "T1190" ] }, { "type": "malware", "id": "malware--92443026-c420-5f37-b867-7f5d23f7d752", "name": "XenoRAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asec-july-2026-apt-attack-report-south-korea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1041" ] }, { "type": "malware", "id": "malware--3701f6d8-c0be-567f-9ff2-1be917e9284a", "name": "dlp-docker.sh (credential harvesting script)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-coder-module-registry-to-serve-malicious-pack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "malware", "id": "malware--d3212de6-40c6-559a-b174-ff32d823d932", "name": "fake Claude installer (ClickFix)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1583", "T1036", "T1674", "T1204" ] }, { "type": "malware", "id": "malware--c2d0a5e3-ca87-5824-bcd0-f8a82e3b6c8d", "name": "iPhone spyware", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/packagist-themes-exploit-iphone-visitors-to-steal-messages-passw/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1195", "T1189", "T1659", "T1539", "T1005" ] }, { "type": "malware", "id": "malware--97125177-29fc-512c-aa26-c7b9e25e34f8", "name": "indexed-btree", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/npm-supply-chain-malware-is-moving-beyond-install-scripts-the-ma/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1195", "T1059", "T1102" ] }, { "type": "malware", "id": "malware--3739c10e-61db-5c3c-a072-604b1d8be436", "name": "malicious GitHub Actions workflow (github_actions_security.yml)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-campaign-that-never-stopped-tracking-ghostaction-from-2025-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1528", "T1567" ] }, { "type": "malware", "id": "malware--e9958458-6d3d-5300-80f4-216ee4ca1dfe", "name": "matrix-bird-agent", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "malware", "id": "malware--6dcb9b17-4840-57b0-b340-c5cefda82db0", "name": "modular RAT", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malicious-exodus-installer-steals-browser-credentials-and-turns/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1195", "T1204", "T1059", "T1055", "T1539", "T1090" ] }, { "type": "malware", "id": "malware--1b164972-828f-582d-9c1d-ec6e47f49f2a", "name": "mqtt-bird-agent", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "malware", "id": "malware--ed585f6a-c094-5cd5-8e45-3a32224eaa30", "name": "p2pwn", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1190", "T1133", "T1505", "T1078" ] }, { "type": "malware", "id": "malware--61bdf659-d289-5401-98be-02b6ebe2d03a", "name": "reverse_ssh", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1190", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--c3112cfb-fd3f-5b3e-b1ec-a28895bfc16b", "name": "reverse_ssh", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/critical-vmware-vcenter-directory-traversal-flaw-used-in-global/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1190", "T1059", "T1105", "T1572" ] }, { "type": "malware", "id": "malware--8ae3e3d9-62b2-5fd5-a2ab-4a0271571764", "name": "ted backdoor (HAProxy implant)", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-kor/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1195", "T1100", "T1005", "T1071", "T1562" ] }, { "type": "malware", "id": "malware--18e67ae0-a97e-5e80-be17-daa18f690268", "name": "wp2shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korea-infects-thousands-of-devices-worldwide-through-fake/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1100", "T1059" ] }, { "type": "malware", "id": "malware--fa6a8f01-5aef-58f1-b113-41beba66cdad", "name": "wp2shell", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wp2shell-cisa-adds-to-kev-wiz-details-webshell-installation-at-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1059", "T1003" ] }, { "type": "malware", "id": "malware--00b4b542-991c-55d5-b239-84623d4628a9", "name": "x47.c", "is_family": false, "confidence": 40, "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1568" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1568", "T1090", "T1503", "T1562", "T1496" ] }, { "type": "threat-actor", "id": "threat-actor--e867cbef-068a-5b06-af5a-a1c6830e878f", "name": "ALPHV/BlackCat", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-has-a-new-target-is-your-backup-ready/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--0235ea13-dc8c-5104-87fc-627f975894b5", "name": "APT-Q-95", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/nighteagle-targets-russian-companies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1078", "T1133", "T1210", "T1059", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--0ca3d208-2915-5e5f-a1fc-85a779878127", "name": "APT28", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "threat-actor", "id": "threat-actor--d833703f-b5b3-503d-bc97-b7a57a9a820f", "name": "APT28", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--c254f36a-74d3-5702-ba36-ad35901eee24", "name": "APT29", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/anthropic-discloses-claude-ai-misuse-in-cyberattacks-and-surveil/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1195", "T1528", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--dc0ec05e-b1e9-5946-9c84-aa4e4f5027bb", "name": "APT29", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--848c15bb-fc86-5b77-8acd-61b06be72537", "name": "APT31", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--c96dc62f-6b6e-5457-93ca-a565ed10f502", "name": "APT31", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--fceb904f-4308-5319-8b0a-408883b5cb83", "name": "APT35", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-charges-17-iranian-hackers-offers-10m-rewards-for-5-of-them/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--096e3c9b-657e-5ce4-8b38-12a7a6f47e85", "name": "APT36", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt36-linked-hackerai-implant-shows-signs-of-llm-assisted-malwar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1566", "T1204", "T1071", "T1505" ] }, { "type": "threat-actor", "id": "threat-actor--0e911945-6049-5a69-81ba-01d104fb597a", "name": "AcSig", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1583", "T1036", "T1674", "T1204" ] }, { "type": "threat-actor", "id": "threat-actor--bf021513-9e53-56c9-9189-22f007371beb", "name": "AiLock", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-11T00:00:00Z", "modified": "2026-10-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ailock-ransomware-strikes-morgan-services-inc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--6ee14d87-e387-540b-9f6e-5026c35f56b5", "name": "Akira", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/one-missing-mfa-control-lets-credential-spray-become-full-akira/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1688" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1110", "T1078", "T1688", "T1486", "T1562" ] }, { "type": "threat-actor", "id": "threat-actor--948eebe2-5172-57dc-a37b-f99b3d225395", "name": "Akira", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/akira-ransomware-group-claims-stransky-heiz-mess-regeltechnik-gm/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--a47962e5-9e02-5c5b-b722-30630a0b0790", "name": "Alibaba", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--cdbbf067-a8e6-599a-8a86-d02b77294335", "name": "Alibaba", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--756678de-a8bf-56b7-b633-74a0a22a4411", "name": "AndroidKitKat", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/octagon-android-bot-targets-crypto-wallets-and-banking-apps-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1082", "T1056", "T1573", "T1113" ] }, { "type": "threat-actor", "id": "threat-actor--95485a73-2b27-53d6-be67-2cbbeafe331e", "name": "AnonyMousKIT", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-anonymouskit-phaas-steals-apple-ids-and-2fa-codes-to/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" } ], "labels": [ "T1566", "T1621", "T1111", "T1539", "T1684" ] }, { "type": "threat-actor", "id": "threat-actor--38eaf074-3473-59c3-bd1d-6b3bb938f8ee", "name": "Aurora", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/aurora-ransomware-affiliate-uses-cursor-ai-to-plan-attacks-again/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1558" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1021", "T1558", "T1071", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--6a5ae9cf-980f-5c77-bef5-88961e20ad13", "name": "Azazel", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/gentlemen-ransomware-affiliate-uses-mcp-as-c2-channel-in-live-cy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1595", "T1059", "T1078", "T1552", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--7fed9ef7-6d3e-55a9-858b-8220f15ddb8e", "name": "BREEZE COMET", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-breach-brazilian-financial-firms-and-execute-hundreds-of/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1566", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--23e4e4d7-fba0-5904-a783-a1d6907d8985", "name": "BYOD", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/trump-mobile-byod-breach-leaks-3-615-customer-records/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--cb8cc80a-a9c3-5ba7-ae91-9a3c78259af7", "name": "Balonx Sistema", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/balonx-phaas-steals-bank-otps-in-real-time-while-ai-calls-and-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1557", "T1539", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--a429a44b-3423-5e61-b284-3f284707a057", "name": "Bearlyfy", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--e6713b82-452b-5f5f-93cb-c3ad47d98e56", "name": "BigBear 2.0 operator (alias 'General Boss')", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-microsoft-365-phishing-service-bypassed-mfa-at-258-organ/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" } ], "labels": [ "T1557", "T1539", "T1566", "T1111" ] }, { "type": "threat-actor", "id": "threat-actor--6b712713-54f9-5f9a-b010-94991055d4ad", "name": "Black Axe", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/police-arrests-dozens-of-suspects-in-global-cybercrime-crackdown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--63939762-d15d-5bf6-b300-94735d05c52d", "name": "BlackMatter", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-has-a-new-target-is-your-backup-ready/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--dafff95d-d19c-5525-beef-eef47cf12f7f", "name": "Blind Eagle", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-31T00:00:00Z", "modified": "2026-08-31T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blind-eagle-linked-loader-uses-github-vbscript-powershell-and-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1118" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" } ], "labels": [ "T1059", "T1086", "T1118", "T1204", "T1193" ] }, { "type": "threat-actor", "id": "threat-actor--66766e03-763a-5ed2-ab90-93b223aa78a6", "name": "BlueDelta", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "threat-actor", "id": "threat-actor--fdf60d6f-50c0-59cd-a418-3e4825935d77", "name": "BlueDelta", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--8e080911-faa3-5d7f-8861-2e8994769132", "name": "Booba Project", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-disrupts-university-of-illinois-chicago-college-of-me/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1486", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--2b73c843-b0d7-5cd4-ac51-c53ecb6a194a", "name": "CISA Red Team", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-red-team-compromises-active-directory-and-critical-business/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1087" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1566", "T1087", "T1068", "T1552", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--d170e54d-ad84-5961-badb-1b5e1d58a431", "name": "CameraSwarm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-14-500-dahua-web-cameras-in-35-day-campaign/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1190", "T1133", "T1505", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--49be72ae-9ee6-5e8a-bdfd-aed81bb670bf", "name": "Cameron Nicholas Curry", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/tech-contractor-for-brightly-software-sentenced-to-2-years-in-pr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1005", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--f780059c-8cab-540b-bec6-0804e326b0d5", "name": "China General Technology Research Institute (CGTRI)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mi5-issues-spy-alert-over-chinese-state-linked-theft-of-uk-unive/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--69e884c0-7e35-5192-811a-971e7814fbb0", "name": "China-based operators", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/rathat-lets-an-ai-assistant-read-your-phone-s-screen-and-tap-thr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1111" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1189", "T1059", "T1056", "T1111", "T1674", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--687c6632-cf90-50bf-89ae-5ff540ad2f56", "name": "China-linked (suspected, unconfirmed)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/researchers-observe-first-near-autonomous-ai-attack-on-governmen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1596" }, { "source_name": "MITRE ATT&CK", "external_id": "T1593" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1596", "T1593", "T1190", "T1005", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--3fbd1a1c-51cb-5480-8480-a89c20244987", "name": "China-nexus", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-hackers-target-myanmar-diplomats-with-government-the/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1059", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--94a2767f-c8a6-550b-9b79-650c6fa124b3", "name": "China-nexus actor (suspected)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-04T00:00:00Z", "modified": "2026-10-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-talos-details-antino-backdoor-used-by-china-nexus-actor-ag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1566", "T1071", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--db683fd5-96c9-5fc1-979e-71ea43e0b16c", "name": "China-nexus threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1204", "T1059", "T1573" ] }, { "type": "threat-actor", "id": "threat-actor--c6bf1dbe-9029-5f05-a841-2e045a4249e5", "name": "Chinese-speaking threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-chinese-hackers-turn-vmware-vcenter-rce-into-root-back/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1053", "T1078", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--97aa92a9-f2fd-5c96-a3db-f2289fff6d65", "name": "Chinese-speaking threat operators", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/attack-cases-in-korea-involving-the-installation-of-radmin-and-u/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1021", "T1219", "T1090", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--fcba5e3b-ea47-55cc-866f-30734d0e5257", "name": "Chinese-speaking threat operators", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-speaking-hackers-use-claude-qwen-and-deepseek-ai-agents/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1595", "T1190", "T1105", "T1100", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--03087ed2-5d5d-56a5-a954-d848ac2314d3", "name": "ClawHavoc", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/openclaw-novastealer-attacks-target-60-crypto-wallets-ssh-keys-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1566", "T1005", "T1555", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--d8308b95-118d-554a-9712-28380ba61906", "name": "ClearFake", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wordlistloader-hides-shellcode-in-plain-english-words-to-deliver/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1204", "T1059", "T1027", "T1055" ] }, { "type": "threat-actor", "id": "threat-actor--0bc97eec-60e8-570f-9950-efa5f5c23a01", "name": "Clop", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/clop-created-custom-web-shell-for-windchill-data-theft-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1212" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1081" } ], "labels": [ "T1190", "T1100", "T1212", "T1005", "T1041", "T1081" ] }, { "type": "threat-actor", "id": "threat-actor--4f605287-62a0-58d1-92a3-99fc50494b6f", "name": "Clop", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/first-ever-exploitation-of-ptc-windchill-vulnerability-cve-2026/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" } ], "labels": [ "T1190", "T1100" ] }, { "type": "threat-actor", "id": "threat-actor--d35d7bba-5715-5969-9f40-443985d5b540", "name": "Clop", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1145" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" } ], "labels": [ "T1190", "T1145", "T1491" ] }, { "type": "threat-actor", "id": "threat-actor--fdb71fae-e248-5294-9a12-8474e99a89f2", "name": "Clop", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-breaches-clop-leak-site-and-steals-onion-service-ke/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1505", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--25de0d8d-2e57-5f4b-80e6-c3ac350f1f36", "name": "Contagious Interview", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--2d77180a-c1c9-5349-b012-a8d3b03feeb6", "name": "Contagious Interview", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-operators-move-beyond-git-hooks-with-trojan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1195", "T1204", "T1574", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--5d13c70d-5f2e-59bb-a95c-8fd173b9775d", "name": "Contagious Interview", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--dca35ee9-1d61-5686-8afc-6382c62ce346", "name": "Contagious Interview", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "threat-actor", "id": "threat-actor--61817a16-980c-5dbb-81e2-1729ce42839e", "name": "Core Werewolf", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-26T00:00:00Z", "modified": "2026-08-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/core-werewolf-hackers-deploy-new-corerat-malware-against-russian/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" } ], "labels": [ "T1566", "T1204", "T1059", "T1082", "T1005", "T1070" ] }, { "type": "threat-actor", "id": "threat-actor--985e6b4d-e8dc-58cd-ad28-253f3b77b046", "name": "CyberAv3ngers", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-water-sector-campaign-now-confirmed-in-12-states-georgia-s-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1190", "T1133", "T1078", "T1489", "T1485" ] }, { "type": "threat-actor", "id": "threat-actor--39f930f9-7ec2-54d7-a263-4ea8f1e0e4e6", "name": "DPRK", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bitget-critical-breach-387-5m-stolen-via-zero-days-in-security-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1100", "T1059", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--544ce5ef-6924-502c-9ca7-70ed7853baa3", "name": "DPRK", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "threat-actor", "id": "threat-actor--55b41c6e-971c-5326-8a16-e0691be670a2", "name": "DPRK", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-operators-move-beyond-git-hooks-with-trojan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1195", "T1204", "T1574", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--ea1cbba7-e40a-5430-9025-005b402e7400", "name": "DPRK", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--f32f656b-b5ff-5fb3-b29e-32e04ca4e086", "name": "DPRK (suspected)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bitget-confirms-351-6-million-hot-wallet-hack-suspends-withdrawa/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--00a656a5-c1e0-50ce-967a-571975b07569", "name": "DPRK-aligned (APT37 overlap, medium confidence)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-backdoor-haproxy-servers-to-spy-on-south-kor/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1195", "T1100", "T1005", "T1071", "T1562" ] }, { "type": "threat-actor", "id": "threat-actor--7c739b85-35b0-5825-a06d-f27c630ceb90", "name": "DPRK-linked actors", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korea-linked-malware-abuses-ethereum-transactions-as-cover/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1195", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--ac09e989-c7e9-5e32-b52d-fbd3291d3aaa", "name": "DPRK-linked operators", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dprk-linked-hackers-add-hashhiding-to-blockchain-c2-network-for/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1566", "T1071", "T1105", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--3101249e-980e-5fd1-8a6b-5bab961a9cc3", "name": "Dark Caracal", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dark-caracal-deploys-new-gocaracal-malware-with-ethereum-based-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1583", "T1105", "T1573", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--14a5eb95-7085-51b7-b391-6773b1bc9e23", "name": "DeadLock", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1489", "T1548" ] }, { "type": "threat-actor", "id": "threat-actor--53f4ed92-3a55-5607-9d56-70af050c0a71", "name": "DeepSeek", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--94d1fcd9-dc0e-5f92-a533-735779707cec", "name": "DeepSeek", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--7c85e3cc-2339-5a92-b0ab-10f0c9c2c570", "name": "Diamond Sleet", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/new-js-stealer-weaselbiscuit-found-in-13-npm-packages-harvesting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" } ], "labels": [ "T1195", "T1059", "T1005", "T1528" ] }, { "type": "threat-actor", "id": "threat-actor--3a4adb6f-d9c6-5435-9849-16c050763d31", "name": "Earth Berberoka", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/earth-berberoka-linked-hackers-target-brazil-with-linux-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1190", "T1505" ] }, { "type": "threat-actor", "id": "threat-actor--8e7ccc64-2d43-59f2-a9ec-412c60ede4a0", "name": "Emperador", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/navitrans-ransomware-claim-by-emperador/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--a4a11fe5-32bd-5a2d-be63-c8846b30d0a3", "name": "EndZone", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--27c12fd1-bc08-5242-88e2-bab2d98069dc", "name": "Everest", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--c87a7b08-7661-594b-a9bf-212e701ecf7c", "name": "Exilware", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-powered-brazetsu-malware-turns-compromised-corporate-pcs-into/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1059", "T1539", "T1005", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--5c77485a-a305-5218-9754-054eae8992d7", "name": "FSB Centre 18", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105" ] }, { "type": "threat-actor", "id": "threat-actor--6965d5e2-66d5-51b0-8ea3-95b5d0a3b780", "name": "FamousSparrow", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-famoussparrow-is-targeting-government-organizations/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--9f4caca2-d126-5df7-89bf-188a5074814b", "name": "FamousSparrow", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-use-sparrowocky-malware-in-govt-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1190", "T1100", "T1059", "T1113" ] }, { "type": "threat-actor", "id": "threat-actor--2b03ed86-1e6c-5cd2-9a07-31ef3738700c", "name": "Fancy Bear", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "threat-actor", "id": "threat-actor--42684d13-07b3-57d4-8373-75548c159b78", "name": "Fancy Bear", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--41623bd1-242d-59a5-9e29-854c54da4ce9", "name": "Feral Wolf", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--fea0aacb-5e0c-567d-959f-88e8e9740ec1", "name": "Fire Ant", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-fire-ant-hackers-turn-cisco-routers-into-spying-platform/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1543" } ], "labels": [ "T1090", "T1572", "T1071", "T1562", "T1543" ] }, { "type": "threat-actor", "id": "threat-actor--63d4bfb6-323f-5603-8883-589fa91332d3", "name": "Flax Typhoon", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/doj-fbi-seize-flax-typhoon-linked-hacking-tools-microscan-fishhu/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1595", "T1566", "T1110", "T1133" ] }, { "type": "threat-actor", "id": "threat-actor--dae9f2ff-dbcf-5926-bf7d-73bbca64422c", "name": "Flax Typhoon", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-aa26-281a-advisory-chinese-government-linked-actors-with-fb/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1189", "T1110", "T1036", "T1547", "T1114", "T1003" ] }, { "type": "threat-actor", "id": "threat-actor--29a86720-8e3a-5549-b01c-9f2650d47003", "name": "Forest Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-deploy-new-hookedge-backdoor-in-espionage-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1070", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--c479b128-9e6c-5d2b-83a3-ae5e61b04c9e", "name": "Forest Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bluedelta-targets-defense-and-diplomacy-with-hookedge/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1102" ] }, { "type": "threat-actor", "id": "threat-actor--10fdbf15-1425-5873-bd51-2d3bab6df986", "name": "FulcrumSec", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/novo-nordisk-breach-two-separate-extortion-groups-demands-of-50m/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1078", "T1552", "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--f60c711e-edd6-5b76-9b7a-517c7ca72eff", "name": "FulcrumSec", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-dat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--65c0c727-5b4f-5964-a465-727dc20a4405", "name": "GRU", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bauman-leak-reveals-gru-training-in-malware-exploitation-adversa/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--b1991d56-083e-50a2-aa77-b4c9f30d819d", "name": "GTG-1002", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/anthropic-discloses-claude-ai-misuse-in-cyberattacks-and-surveil/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1195", "T1528", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--9d22e04b-cd12-549e-8c57-917e99aa9998", "name": "General Boss", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bigbear-2-0-phishing-service-bypasses-mfa-in-global-m365-campaig/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1557", "T1539", "T1621", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--17127003-0481-58a5-9270-592287e79b77", "name": "Ghost Dev", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malicious-rubygems-packages-target-cryptocurrency-developers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1195", "T1204" ] }, { "type": "threat-actor", "id": "threat-actor--66795309-09a0-5bc7-b1f9-380b17aa3359", "name": "GoldFactory", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-13T00:00:00Z", "modified": "2026-09-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/android-banking-trojan-gigaplay-vwork-exploits-work-profiles-in/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1059", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--53b7d91c-df74-51b3-a07b-a8935b3245c5", "name": "Gunra", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/joint-us-south-korea-advisory-gunra-ransomware-exploits-fortinet/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1078", "T1486", "T1490", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--5e8e58ab-e3a4-5523-b4e9-70d9a714d056", "name": "Gunra", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-urges-organizations-to-patch-exposed-vpns-and-segment-netwo/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1078", "T1021", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--f210aabb-bac5-5d65-be9a-a46b2bde1f63", "name": "Gunra", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asec-june-2026-apt-attack-report-south-korea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1566", "T1204", "T1059", "T1190" ] }, { "type": "threat-actor", "id": "threat-actor--11f2f92a-0bf9-5ca1-ad37-c53bc0ac786b", "name": "Hacking Cat", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kaspersky-reports-three-clusters-targeting-russian-enterprises-n/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--b8a58b14-8e36-54a7-9ac1-0fa68b62d9c5", "name": "Hacktron", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ai-built-exploit-and-sign-in-flaw-opened-path-to-internal-openai/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" } ], "labels": [ "T1190", "T1078", "T1552", "T1210" ] }, { "type": "threat-actor", "id": "threat-actor--a77f2828-94d8-57b7-8efa-24356aa0c824", "name": "Handala", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-water-sector-campaign-now-confirmed-in-12-states-georgia-s-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1190", "T1133", "T1078", "T1489", "T1485" ] }, { "type": "threat-actor", "id": "threat-actor--e251eb9f-48eb-58a1-a687-dc14e585c7a3", "name": "Head Mare", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/trueconf-security-advisory-av26-835/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1195", "T1190", "T1204", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--5cc6b736-e08a-5a13-9bd8-8653ee2b1d07", "name": "HexMage", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/magecart-hackers-abuse-ethereum-smart-contracts-to-steal-card-da/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1189", "T1056", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--ac31f81c-627d-5e8f-9183-b8aaa736cf34", "name": "HoneyMyte", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kern/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1014", "T1055", "T1140", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--19b0a324-651d-5b92-837d-76f4733e720c", "name": "ICE RELIC", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--982998b9-32b2-5da9-82f7-0d042757ae88", "name": "ICE RELIC", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--2497ebac-41ec-586e-ab4e-4dd873bee0bc", "name": "INC", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1480" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1480" ] }, { "type": "threat-actor", "id": "threat-actor--509b832b-de3b-5510-9d9c-291916d1b279", "name": "INC", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--31c72637-644d-5369-9739-4362ae83c207", "name": "INC Ransom (affiliate)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1489", "T1548" ] }, { "type": "threat-actor", "id": "threat-actor--de355368-09dd-5480-ad62-79a66dd95051", "name": "INJ3CTOR3", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/inj3ctor3-s-freepbx-jomangy-campaign-six-layer-self-healing-pers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1190", "T1100", "T1053", "T1037", "T1562" ] }, { "type": "threat-actor", "id": "threat-actor--43c18252-11b7-5787-b4a6-0a09132ab220", "name": "Indonesian threat actors", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mantax-otax-combines-android-ransomware-and-spyware-for-double-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1204", "T1059", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--55f85053-5538-584e-83d8-bde23a1a3459", "name": "Insomnia", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--991ea333-6a9b-5f5e-8602-06d3923cb66f", "name": "Iran-linked (preliminary attribution)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-water-sector-campaign-now-confirmed-in-12-states-georgia-s-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1190", "T1133", "T1078", "T1489", "T1485" ] }, { "type": "threat-actor", "id": "threat-actor--f523759e-efaa-5975-89a5-8a79bc6b6221", "name": "Iran-nexus", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iran-linked-hackers-shut-down-uk-power-plant-for-four-days-in-cy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1584" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1529" } ], "labels": [ "T1584", "T1021", "T1078", "T1529" ] }, { "type": "threat-actor", "id": "threat-actor--50e285ce-0685-5a50-9c56-9174fb61f4e4", "name": "Iran-nexus actor (CL-STA-1178)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/blinder-tunnel-campaign-targets-iraqi-infrastructure/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1566", "T1059", "T1547", "T1105", "T1571", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--ba15476c-dded-5f3d-9aa9-87a28c435f13", "name": "Iranian MOIS", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iranian-state-linked-hackers-deploy-windows-malware-chosen-brick/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1656", "T1547", "T1562", "T1114", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--3163f698-fd7f-5b57-abfc-b3a63a197fd3", "name": "Iranian hackers", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/water-campaign-expands-new-jersey-and-alabama-utilities-join-the/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "threat-actor", "id": "threat-actor--2c3eee7e-1919-599d-b109-92efebe6d645", "name": "Iranian state-linked actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-24T00:00:00Z", "modified": "2026-09-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/iranian-apt-uses-chosenbrick-windows-malware-for-espionage/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1204", "T1036" ] }, { "type": "threat-actor", "id": "threat-actor--c3ea49e5-27e2-5ab6-90a9-8c9a27c9a321", "name": "JADEPUFFER", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-3168-agentic-driven-cloud-attacks-using-compromised-servic/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1526" }, { "source_name": "MITRE ATT&CK", "external_id": "T1651" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1078", "T1552", "T1526", "T1651", "T1571", "T1485" ] }, { "type": "threat-actor", "id": "threat-actor--cabbc2f7-2308-5132-91e7-d23765185815", "name": "JadePuffer", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/jadepuffer-agentic-ransomware-first-documented-ai-agent-driven-e/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" }, { "source_name": "MITRE ATT&CK", "external_id": "T1530" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1053", "T1136", "T1530", "T1486", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--547d3d3d-0def-5adb-bf16-7ed602342619", "name": "JungleBamboo", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--ed4a2086-520f-57a3-97a8-16372645b416", "name": "JungleBamboo", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--b38456e9-92e2-5e4e-b444-a33e692c24a0", "name": "KREMLIN (REF9334)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kremlin-malware-installs-chrome-extensions-users-never-approved/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1176", "T1539", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--9b6d2ee9-8618-5fe6-b9c2-b7295b852f97", "name": "Kairos", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/slate-valley-unified-school-district-voted-not-to-pay-ransom-dem/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--f372d44d-22e0-5737-ba4d-76c3234b6936", "name": "KillSec", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/killsec-ransomware-group-disrupted-in-international-law-enforcem/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1530" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1190", "T1530", "T1486", "T1490", "T1567", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--1ffd2058-abad-550a-846e-90f02d784a0e", "name": "Kimsuky", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-07T00:00:00Z", "modified": "2026-09-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimsuky-uses-the-ai-agent-opencode-to-create-decoys-as-its-githu/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1566", "T1193", "T1059", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--59d3d4e7-793f-50e8-96d5-ebb8f70464e2", "name": "Kimsuky", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asec-july-2026-apt-attack-report-south-korea/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--5e93746e-71a4-5f11-ae8a-04c6fd9a4c4b", "name": "Kimsuky", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kimsuky-moves-ai-assisted-development-into-local-environment-wit/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" } ], "labels": [ "T1566", "T1204", "T1059", "T1102" ] }, { "type": "threat-actor", "id": "threat-actor--d39328d8-946b-5aae-98a0-42ce2600c722", "name": "KnYuan", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-22T00:00:00Z", "modified": "2026-08-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hacker-uses-deepseek-ai-to-automate-vulnerability-exploi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1595", "T1190", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--02a21d2b-e26f-56ad-8dce-dc29f163b245", "name": "Konni", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/konni-hackers-target-ukraine-with-malicious-lnk-files-and-velvet/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1086" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" } ], "labels": [ "T1193", "T1204", "T1053", "T1086", "T1608" ] }, { "type": "threat-actor", "id": "threat-actor--c346bb02-ad14-5800-b9f9-fece791f40eb", "name": "Laboo.boo", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--61ee43a3-dc26-5686-a1f2-1dc45f193b6a", "name": "Lazarus", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-afd-sys-zero-day-exploited-by-lazarus-hackers-to-gain-sy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" } ], "labels": [ "T1566", "T1204", "T1574", "T1068", "T1014", "T1562" ] }, { "type": "threat-actor", "id": "threat-actor--0726299a-f5a4-568e-abc7-eafcaa278bc7", "name": "Lazarus Group", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resur/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" } ], "labels": [ "T1566", "T1195", "T1583" ] }, { "type": "threat-actor", "id": "threat-actor--6d4dc477-1012-5bdd-9e75-f538b4fe58a3", "name": "Lazarus Group", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-north-korean-threat-actors-compromised-30-0/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--255884e2-887f-5bab-a0d9-cdb9f4f86f53", "name": "LockBit 5", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--dbe3729b-858c-5a3e-b5a2-e7cef49416a9", "name": "LockBit 5", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-22T00:00:00Z", "modified": "2026-08-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/lockbit-5-ransomware-claim-on-u-s-bank/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" } ], "labels": [ "T1486", "T1490" ] }, { "type": "threat-actor", "id": "threat-actor--4e600b3a-6170-534f-a1bb-52537acde6cd", "name": "Longlegs", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1089" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1100", "T1089", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--62d1c393-8783-598a-adfa-9eb7eafa52ef", "name": "Longlegs", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-exploits-sharepoint-vulnerabilities-targeting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--8068983e-3a5c-52f5-905d-595707be26dd", "name": "Lynx", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-rust-encryptor-with-decentralized-recovery-i/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1480" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1480" ] }, { "type": "threat-actor", "id": "threat-actor--95bf3fa2-0e3f-5389-86ef-f3da7abb3c44", "name": "Lynx (affiliate)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deadlock-ransomware-uses-blockchain-to-resist-infrastructure-tak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1489" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1486", "T1490", "T1562", "T1070", "T1489", "T1548" ] }, { "type": "threat-actor", "id": "threat-actor--30efbd0f-1929-5945-84df-df4ef488d379", "name": "MALFEX", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-01T00:00:00Z", "modified": "2026-10-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/malfex-supply-chain-campaign-targets-npm-and-github/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" } ], "labels": [ "T1195", "T1059", "T1503" ] }, { "type": "threat-actor", "id": "threat-actor--402e6248-9952-52d9-997a-430de58d2deb", "name": "MSNightmare", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/prettyprague-poc-claims-avast-antivirus-zero-day-enables-system/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1068", "T1003" ] }, { "type": "threat-actor", "id": "threat-actor--7e14ef5f-135a-523e-b991-ae146fcf9b3c", "name": "MSNightmare", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hardbreacher-exploit-targets-kaspersky-endpoint-security-zero-da/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" } ], "labels": [ "T1068" ] }, { "type": "threat-actor", "id": "threat-actor--c8579be1-2dff-53ce-8fae-8d9b5b1f128e", "name": "MSNightmare", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/falconflank-poc-claims-crowdstrike-falcon-zero-day-enables-privi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" } ], "labels": [ "T1068", "T1548" ] }, { "type": "threat-actor", "id": "threat-actor--2c1a585f-9aa8-56e9-a185-fa0c529ffba3", "name": "Mabna Institute", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/us-charges-17-iranian-hackers-offers-10m-rewards-for-5-of-them/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--58c3ade9-a7ca-593e-a8dd-a7e280ec5fe6", "name": "Mabna Institute", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/in-rare-move-alleged-iranian-state-hacker-extradited-to-us/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1020" } ], "labels": [ "T1114", "T1020" ] }, { "type": "threat-actor", "id": "threat-actor--3c100d71-7350-53b3-bfd5-5c412dff4974", "name": "Medusa", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/medusa-ransomware-tallies-hundreds-of-new-victims-says-updated-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1020" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1486", "T1020", "T1562", "T1059", "T1003", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--ebd0923e-35bb-567e-8dd0-2b6cf6dd03db", "name": "Mentalpositive", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/macsync-malware-uses-public-icloud-calendars-to-deliver-new-payl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1159" }, { "source_name": "MITRE ATT&CK", "external_id": "T1037" } ], "labels": [ "T1204", "T1059", "T1102", "T1159", "T1037" ] }, { "type": "threat-actor", "id": "threat-actor--316e95c0-c667-562c-8633-450c1ef10d78", "name": "Midnight Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1669", "T1659", "T1557", "T1621", "T1548", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--7a28a4e1-bfdc-5123-8538-5c1bb8379bea", "name": "Midnight Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--1f848889-580f-542d-9f20-9c1df80d9077", "name": "MiniMax", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--cb98b532-0815-5ee9-902a-40c23090bb3c", "name": "MiniMax", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--064e86ad-b4b9-5d51-8fd0-ff591897d70f", "name": "Ministry of State Security (MSS)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mi5-issues-spy-alert-over-chinese-state-linked-theft-of-uk-unive/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--d6e3b493-b5c0-561f-a1d5-0171cd621ffb", "name": "MoYu", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-24T00:00:00Z", "modified": "2026-08-24T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-infect-android-car-head-units-with-proxy-botnet-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1505", "T1027", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--06a17e66-5fcf-5cce-9ee2-ea7ecde1ea6b", "name": "Moonshot AI", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--156b5f58-af5c-5532-96b4-a166bd89736a", "name": "Moonshot AI", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--46941284-6651-5046-8f74-cebf6135d82f", "name": "MuddyWater", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-26T00:00:00Z", "modified": "2026-08-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/muddywater-linked-dindoor-backdoor-abuses-legitimate-deno-runtim/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1059", "T1105", "T1497", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--4fa98843-c150-577d-b0fe-5a553716dd9e", "name": "Mustang Panda", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/apt-group-honeymyte-upgrades-coolclient-the-backdoor-gets-a-kern/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1140" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1014", "T1055", "T1140", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--a0e86f25-d01d-5a3c-9df4-cd68411fb2af", "name": "Nanjing Xinjiuwei Network Technology Company", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--0ee6b2a5-73f7-5636-b317-21a397d62991", "name": "Nexus marketplace", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/153-million-driver-license-images-offered-on-dark-web/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1597" } ], "labels": [ "T1597" ] }, { "type": "threat-actor", "id": "threat-actor--372aed02-e451-5475-92ca-0c03dc9c874b", "name": "NightEagle", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kaspersky-reports-three-clusters-targeting-russian-enterprises-n/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--efc5859f-66a7-5cd2-9f84-5f5b2c4a7449", "name": "NightEagle", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/nighteagle-targets-russian-companies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1078", "T1133", "T1210", "T1059", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--452dcaee-21d8-55b4-b65b-a8e07d236156", "name": "NightSpire", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--2d4f4fdb-2e4d-5c06-9fb2-af7540f49c68", "name": "North Korea", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "threat-actor", "id": "threat-actor--de13a284-5bc7-530a-9e61-f1367e9d63e7", "name": "OpenAI ExploitGym agents", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/700-openai-agents-coordinate-attack-on-hugging-face-and-gain-rem/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1059", "T1071", "T1105" ] }, { "type": "threat-actor", "id": "threat-actor--812d20bd-e21b-519a-a948-50a39bb93500", "name": "Panzer", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--977a7204-bd54-5242-80c3-9cafe12bbca0", "name": "Panzer", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-hits-16-victims-across-11-countries-with-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--a3570cc3-ec98-5059-8761-b5e33928bbf9", "name": "Panzer RaaS operator", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/panzer-ransomware-emerges-with-windows-linux-esxi-and-freebsd-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1486", "T1490", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--ccf7a35b-a32c-5bc6-92c7-50e43c6606a6", "name": "Phantom Deal", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-04T00:00:00Z", "modified": "2026-09-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-pose-as-executives-and-use-fake-ndas-to-steal-corporate/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1534" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1534", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--8bdb7c0d-2b03-503f-974e-750a056ab04e", "name": "QTFY", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-27T00:00:00Z", "modified": "2026-08-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-disables-china-linked-hacking-tools-used-against-us-agencies/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1595", "T1090", "T1190", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--4bf3d744-df88-5bb6-b27e-3ac00c0c7211", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/atf-investigating-major-cyber-incident-after-ransomware-group-cl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1490", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--61c3f639-ce53-55b5-add1-6a94ba8287ac", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-management-plane-is-the-attack-surface-what-cisco-fmc-s-expl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1190", "T1100", "T1059", "T1133" ] }, { "type": "threat-actor", "id": "threat-actor--7d103d93-06be-58d4-a56b-8c0b7a30da8c", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/touring-club-suisse-ransomware-claim-by-qilin/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--8355f69e-ca97-533f-b3a8-2b64f2d83ec9", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--9fda7f17-2d50-558c-8a6b-2e8ba46f68cb", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/qilin-targets-canadian-firm-b-wright-drywall-in-ransomware-attac/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--a96743fa-9ec9-5018-b0ea-2d718341dfc8", "name": "Qilin", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/qilin-ransomware-core-member-extradited-from-japan-to-germany/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--933f2354-e16d-52a5-aef6-f218b8532121", "name": "REF9334", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kremlin-banking-malware-hijacks-chrome-and-edge-to-steal-credent/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1176" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" } ], "labels": [ "T1176", "T1557", "T1539", "T1555" ] }, { "type": "threat-actor", "id": "threat-actor--636d2f27-7271-587b-a034-fa6fb2783148", "name": "Ransom Busters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-affiliate-poses-as-recovery-firm-to-re-extort-victims/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1585" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1490" } ], "labels": [ "T1583", "T1585", "T1608", "T1199", "T1071", "T1102", "T1560", "T1041", "T1486", "T1490" ] }, { "type": "threat-actor", "id": "threat-actor--b28ffa20-970a-5a63-a9b1-92d03ced9f55", "name": "Ransom Busters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-20T00:00:00Z", "modified": "2026-08-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransom-busters-ransomware-affiliate-poses-as-recovery-firm-to-re/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" }, { "source_name": "MITRE ATT&CK", "external_id": "T1565" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" } ], "labels": [ "T1657", "T1565", "T1656" ] }, { "type": "threat-actor", "id": "threat-actor--c28133b6-10ad-5f97-9859-dbd9a4d850f7", "name": "Red Heron", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-16T00:00:00Z", "modified": "2026-09-16T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/red-heron-hackers-exploit-critical-gitea-rce-to-steal-source-cod/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1014" } ], "labels": [ "T1190", "T1100", "T1014" ] }, { "type": "threat-actor", "id": "threat-actor--dc6b990c-b2f0-539d-b9ca-92ca9bf3e8f8", "name": "Red Heron", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korea-infects-thousands-of-devices-worldwide-through-fake/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1100", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--cf8ed143-1fd7-5f45-888a-50db7b36e8eb", "name": "RemoteX", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shadow-hvnc-lets-hackers-operate-a-second-windows-desktop-invisi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1059", "T1113", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--098ad636-20df-5705-93c4-661c7f141ca3", "name": "Rhysida", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/berlin-won-t-pay-extortion-group-claiming-data-theft/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--356c21f8-96de-5837-92a1-490850ae261f", "name": "Rhysida", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claim/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--e958b6fa-0d61-5d46-aadb-592eec448d08", "name": "Rogue OpenAI agents", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/wikimedia-rogue-openai-agents-behind-unauthorized-wikipedia-edit/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" } ], "labels": [ "T1659" ] }, { "type": "threat-actor", "id": "threat-actor--ca7f2b38-3dcf-5e07-bbcf-795a1beb43ff", "name": "Russian-speaking threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-deploy-hundreds-of-ai-agents-to-exploit-papercut-flaws-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1087" }, { "source_name": "MITRE ATT&CK", "external_id": "T1136" } ], "labels": [ "T1190", "T1059", "T1021", "T1078", "T1087", "T1136" ] }, { "type": "threat-actor", "id": "threat-actor--fdfa5580-73e3-5e04-93cc-f3c31514f7a1", "name": "Rydox administrators", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/rydox-marketplace-admin-pleads-guilty-faces-22-years-in-prison/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--dc37d06c-d668-5ad8-a99b-775c0b7b6f63", "name": "SALTY SPIDER", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sality-botnet-infrastructure-dismantled-in-joint-global-takedown/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1583", "T1071", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--3c5f9dce-e283-5c23-b172-ccd647670b4a", "name": "SETTRA", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/settra-ransomware-uses-meshagent-rmm-and-byovd-to-encrypt-window/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1219", "T1562", "T1059", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--81093a57-54e9-58d8-a32d-4908ba043a22", "name": "STORM-2945", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--b9e3971a-4726-5c34-be1d-c9711e1a80a7", "name": "SafePay", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--07e3c606-2172-56f8-89e7-4d3c440d469f", "name": "Sandworm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-management-plane-is-the-attack-surface-what-cisco-fmc-s-expl/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1190", "T1100", "T1059", "T1133" ] }, { "type": "threat-actor", "id": "threat-actor--e54aca3a-14fe-58a4-9b80-6889e74969ca", "name": "Sandworm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--f177c89c-f9bf-58aa-91bf-0b6ad1a7273f", "name": "Satanic", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/659-stripe-merchant-api-keys-leaked-online-exposing-688-000-cust/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1213" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1528", "T1552", "T1213", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--def2b55e-0e6f-5caf-b29f-5728625c37a0", "name": "Scattered LAPSUS$ Hunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigati/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1190", "T1491", "T1656", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--9f98e656-4b33-56ad-ac5d-c3a53ba5839a", "name": "Scattered Lapsus$ Hunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/alleged-shinyhunters-leader-arrested-in-jordan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1491", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--330ff00d-56e8-5853-9189-db3d647e1832", "name": "Security researchers", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/researchers-execute-code-inside-fortune-500-companies-via-ai-age/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1195", "T1059", "T1105" ] }, { "type": "threat-actor", "id": "threat-actor--3aa1d236-6d7f-54c9-b10e-f558f4efd43a", "name": "Shai-Hulud", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/npm-supply-chain-worm-returns-after-four-month-dormancy-with-sam/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--a69e5501-ecc1-51b1-a89d-4901076248bb", "name": "Shai-Hulud", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shai-hulud-trinitite-supply-chain-worm-hits-npm-package-with-150/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1677" } ], "labels": [ "T1195", "T1552", "T1677" ] }, { "type": "threat-actor", "id": "threat-actor--20347bbc-40c7-5ddb-b5ca-38a3029fed31", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-arrests-key-suspect-in-major-hack-of-agents-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" } ], "labels": [ "T1491" ] }, { "type": "threat-actor", "id": "threat-actor--2e1afa2a-defa-5013-af41-e58a110b176c", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-arrests-founder-of-ransomware-negotiation-firm/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--36ea2f60-b3ff-50e5-9808-1b1d9825616c", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/alleged-shinyhunters-leader-arrested-in-jordan/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1491", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--400f0c86-6323-56e4-b736-96547aa52dd9", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-25T00:00:00Z", "modified": "2026-08-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-impersonate-security-staff-to-steal-credentials-in-relia/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1534" } ], "labels": [ "T1566", "T1621", "T1534" ] }, { "type": "threat-actor", "id": "threat-actor--5b8c77a4-3ece-5c66-b9b5-7f08d2d811e2", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/florida-confirms-dmv-database-breached-via-stolen-police-account/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1078", "T1110", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--723ece45-bb0f-5e3e-b3db-03782f478db0", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-hacked-clop-leak-site-using-grav-cms-path-traversal/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1145" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" } ], "labels": [ "T1190", "T1145", "T1491" ] }, { "type": "threat-actor", "id": "threat-actor--743a686e-374b-576b-a242-35a70fba5569", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-claims-284m-patient-records-from-mckesson-breach/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1078", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--75acfa35-0286-58ae-9cb0-c8034a990c6c", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-hackers-say-they-won-t-publish-massive-trove-of-fbi-employee/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1505", "T1116", "T1572", "T1219" ] }, { "type": "threat-actor", "id": "threat-actor--85544a5d-8b52-5a66-ab35-22eb90e03325", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/dutch-police-arrest-reformed-hacker-in-shiny-hunters-investigati/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1190", "T1491", "T1656", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--8a799090-d408-58dd-8d82-488e65ba92ad", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-claim-fbi-staff-psychiatric-and-medical-records-sto/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--97327bf8-5b92-5efa-86b6-3b0f62cc568a", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-claims-it-breached-fbi-systems-via-an-alleged-unpat/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1078", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--a84e8b3f-2ed3-5661-ad5c-950c2fa317d4", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-breaches-clop-leak-site-and-steals-onion-service-ke/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1190", "T1505", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--b4cc5588-0c59-5855-954c-8b7828df2e25", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/anthropic-discloses-claude-ai-misuse-in-cyberattacks-and-surveil/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1566", "T1195", "T1528", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--bb848232-f4ee-5eee-b7ae-4be8b85a330b", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-01T00:00:00Z", "modified": "2026-09-01T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mckesson-copes-with-fallout-from-data-theft-extortion-attack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1199", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--c2b941f7-7f84-5dc5-80d1-f408af7334e2", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-15T00:00:00Z", "modified": "2026-08-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ringcentral-data-breach-exposed-info-of-1-6-million-accounts/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" } ], "labels": [ "T1566" ] }, { "type": "threat-actor", "id": "threat-actor--c68ed022-1979-5f0b-96ce-481a79341caf", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-allegedly-breached-the-fbi-to-steal-personal-data-o/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1102", "T1491", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--cd9a483b-2327-52d2-951f-c69ea06399b8", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-04T00:00:00Z", "modified": "2026-10-04T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-hacker-rey-allegedly-involved-in-fbi-data-theft-det/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--d395e362-40f3-527a-8a9e-1e744ee45dac", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-have-apparently-breached-fbi-systems-and-have-extracted/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1491", "T1005", "T1567", "T1219" ] }, { "type": "threat-actor", "id": "threat-actor--d4b34441-d6f3-5329-9ecb-21afe8a86a7c", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/accenture-contractor-removed-after-fbi-data-breach-exposes-thous/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1560" }, { "source_name": "MITRE ATT&CK", "external_id": "T1048" } ], "labels": [ "T1190", "T1560", "T1048" ] }, { "type": "threat-actor", "id": "threat-actor--e2880fb6-da50-5223-9992-1a451361889d", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-26T00:00:00Z", "modified": "2026-09-26T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/shinyhunters-claims-breach-of-fbi-jobs-site-exposing-personnel-d/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1491", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--ffc1c5a2-20ca-5d14-aad7-bf5dc782dbb1", "name": "ShinyHunters", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/oracle-peoplesoft-cve-2026-35273-cvss-9-8-mitigations-released-m/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1048" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1190", "T1505", "T1059", "T1048", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--c6247d02-ec61-58e1-a125-e95df5bc79c6", "name": "Silent Ransom Group", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/the-luna-moth-files-weren-t-hacked-here-s-how-they-leaked/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--180d1441-596f-5d47-a5ac-4a86e557ed4b", "name": "Silk Typhoon", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/u-s-offers-10-million-reward-for-chinese-hacker-behind-alleged-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--0c532729-1d11-51e9-86c3-eafb2a5b6555", "name": "SilkParasite", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-nexus-silkparasite-apt-deploys-five-new-rats-against-centr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1102", "T1567", "T1041", "T1059", "T1105", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--e8aac5f1-9fda-5a4a-940f-7296602d10f7", "name": "Silver Fox", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/silver-fox-hackers-target-china-based-organizations-with-counter/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1564" } ], "labels": [ "T1036", "T1204", "T1059", "T1564" ] }, { "type": "threat-actor", "id": "threat-actor--1dc00226-5084-57cf-a495-47e52813bffa", "name": "SilverFox", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/silverfox-malware-campaign-uses-smart-filtering-to-hide-fake-sof/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1194" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" } ], "labels": [ "T1194", "T1073", "T1116", "T1036" ] }, { "type": "threat-actor", "id": "threat-actor--ae0e221f-0314-5cdf-993f-ce3d6419a9f5", "name": "Spirals", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--ec5711a7-e6d3-5502-8ec8-acebda4b75f5", "name": "Spring Ring", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-02T00:00:00Z", "modified": "2026-09-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-pose-as-it-support-on-microsoft-teams-to-target-more-tha/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" } ], "labels": [ "T1566", "T1684", "T1219", "T1557" ] }, { "type": "threat-actor", "id": "threat-actor--2f6aaa7d-6d85-51cf-ac97-2aa7db35423f", "name": "Star Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-apt-star-blizzard-uses-redflick-infection-chain-in-recen/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1204", "T1059", "T1053", "T1105" ] }, { "type": "threat-actor", "id": "threat-actor--d42ba025-f710-5a16-a070-9fd773fd5445", "name": "Star Blizzard", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/star-blizzard-refines-phishing-and-malware-delivery-with-the-red/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1204", "T1053" ] }, { "type": "threat-actor", "id": "threat-actor--9ad3ae3b-d2fe-5f64-95bf-24a855e83c35", "name": "Steamtv Esp.", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/streamrat-android-malware-abuses-accessibility-and-vnc-to-take-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1015" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" } ], "labels": [ "T1566", "T1015", "T1056", "T1113" ] }, { "type": "threat-actor", "id": "threat-actor--3692da13-b69e-517b-863c-209159f9a68a", "name": "StepFun", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--d2b5755b-1d68-5c2a-ad18-fa3e85da52ea", "name": "StepFun", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--1ffad419-3083-5048-84ce-d5acb995f5b8", "name": "StopAndProtect", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/thousands-of-hacked-wordpress-sites-one-operation-unmasking-stop/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1505", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--2165fe55-95fc-50e9-ab13-b490f88bcc5c", "name": "Storm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-ransomware-strikes-gsac-auto-financing/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" } ], "labels": [ "T1486", "T1199" ] }, { "type": "threat-actor", "id": "threat-actor--b6f1afae-ddae-53f9-b9ec-53cce35b3619", "name": "Storm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-ransomware-lists-us-healthcare-provider-west-county-health/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--f2ef1819-7872-54d4-b3bc-f1103e59383f", "name": "Storm", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--ca4cc60e-fb52-5097-8cec-257165f34aed", "name": "Storm-2570", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-25T00:00:00Z", "modified": "2026-09-25T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/beyond-the-ransomware-tracking-storm-2570-s-consistent-tradecraf/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--6beaf873-c720-56a3-abe7-916d8e55db3b", "name": "Storm-2603", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1089" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1100", "T1089", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--c7ffd57c-5409-5b7e-971e-9a34c2221723", "name": "Storm-2603", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-exploits-sharepoint-vulnerabilities-targeting/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--10ee8931-7dc9-5fad-9a8a-ecf042686f96", "name": "Storm-2945", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/captivecrunch-midnight-blizzard-sub-cluster-weaponizes-hotel-wi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1669" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1548" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1669", "T1659", "T1557", "T1621", "T1548", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--47b63df4-b374-536b-9525-c3cc790fcd54", "name": "Storm-2992", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-23T00:00:00Z", "modified": "2026-09-23T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/unmasking-eviltokens-getting-to-the-root-of-device-code-phishing/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" } ], "labels": [ "T1566", "T1621", "T1539", "T1098" ] }, { "type": "threat-actor", "id": "threat-actor--93a192bf-e586-51b4-9244-2d3734e00780", "name": "Storm-2992", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/eviltokens-phaas-disrupted-after-compromising-12-000-microsoft-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1114" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1566", "T1621", "T1528", "T1098", "T1114", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--b15b0640-18af-51e6-bcaf-3677516bc094", "name": "Storm-3068", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-3068-hijacks-azure-devops-pipelines-to-steal-kubernetes-cr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1098" }, { "source_name": "MITRE ATT&CK", "external_id": "T1556" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1651" } ], "labels": [ "T1098", "T1556", "T1078", "T1651" ] }, { "type": "threat-actor", "id": "threat-actor--0b8f32be-b374-53f9-9229-664522605212", "name": "Storm-3069", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-29T00:00:00Z", "modified": "2026-09-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/needymantis-unpacking-a-post-compromise-malware-family-used-in-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1073" }, { "source_name": "MITRE ATT&CK", "external_id": "T1570" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1195", "T1073", "T1570", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--03ba8867-4c82-5e45-9c35-61fce464d345", "name": "Storm-3168", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/storm-3168-agentic-driven-cloud-attacks-using-compromised-servic/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1526" }, { "source_name": "MITRE ATT&CK", "external_id": "T1651" }, { "source_name": "MITRE ATT&CK", "external_id": "T1571" }, { "source_name": "MITRE ATT&CK", "external_id": "T1485" } ], "labels": [ "T1078", "T1552", "T1526", "T1651", "T1571", "T1485" ] }, { "type": "threat-actor", "id": "threat-actor--28d1e9d3-a7de-5fcd-9db3-5106659d5b97", "name": "TA412", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--3b12a338-9e33-5da0-bff8-6bf96442226f", "name": "TA412", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--a70b80d5-56d3-590a-8a25-9e8de92c3a41", "name": "TA419", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-05T00:00:00Z", "modified": "2026-10-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-ta419-hackers-target-us-ai-policy-experts-with-cred/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1556" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1557", "T1556", "T1539" ] }, { "type": "threat-actor", "id": "threat-actor--8c284d80-6936-5080-a6c0-0637275adc9a", "name": "TA4922", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hackers-deploy-packclient-rat-via-tax-themed-phishing-at/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1053" } ], "labels": [ "T1566", "T1059", "T1204", "T1053" ] }, { "type": "threat-actor", "id": "threat-actor--003c038c-7f78-5137-b38c-e8278ee3156e", "name": "TITAN", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/titan-raas-uses-ai-for-data-classification-regulatory-analysis-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1486", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--1fb8943b-0253-5cb9-be3d-3c523cc752fe", "name": "Team PCP", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-12T00:00:00Z", "modified": "2026-08-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/litellm-supply-chain-breach-blast-radius-2-500-organizations-and/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" } ], "labels": [ "T1195" ] }, { "type": "threat-actor", "id": "threat-actor--db71b8c7-51ee-5bc3-98dc-645b9feeeea4", "name": "TeamPCP", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/two-alleged-teampcp-hackers-arrested-in-australia/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1195", "T1059", "T1078", "T1005", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--ff61ea8a-6050-5abb-8410-b67887ed5b84", "name": "TeamPCP", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-git/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1552", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--f56d00be-dd25-53d0-9f3a-8e113fb00991", "name": "TeamPCP-linked", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-tanstack-query-npm-package-to-steal-developer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--418dc6d2-a4a5-5ac0-9084-9138efcab3d8", "name": "The Com", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/uk-man-tied-to-the-com-sentenced-for-blackmail-and-sextortion-ag/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" } ], "labels": [ "T1684" ] }, { "type": "threat-actor", "id": "threat-actor--0705fe1b-6a1b-5a44-993b-f6c9c081d939", "name": "The Gentlemen", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hospital-de-la-santa-creu-breach-claim-by-actor-thegentlemen/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--122c761d-03e5-58d7-9b25-6c818d0157ff", "name": "The Gentlemen", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-victims-seven-seas-group-forma-therapeutics-paessoluc/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1070" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1027", "T1070", "T1567", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--6541a16e-1e4b-55d7-9d34-a6cad44ba849", "name": "The Gentlemen", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/ransomware-hackers-built-their-own-c2-framework-to-steal-passwor/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1583", "T1219" ] }, { "type": "threat-actor", "id": "threat-actor--edb7508b-e4eb-5c80-918c-72b493dad78b", "name": "The Gentlemen", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-07T00:00:00Z", "modified": "2026-10-07T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/gentlemen-ransomware-affiliate-uses-mcp-as-c2-channel-in-live-cy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1595", "T1059", "T1078", "T1552", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--fe9cfec7-ee48-5d8d-947c-adc5c6834e6e", "name": "The Gentlemen", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-18T00:00:00Z", "modified": "2026-08-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/threat-actors-use-claude-code-codex-and-deepseek-ai-to-power-cyb/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1133" } ], "labels": [ "T1059", "T1078", "T1133" ] }, { "type": "threat-actor", "id": "threat-actor--4243c01e-0a02-5307-a54c-9449088e385e", "name": "Toy Ghouls", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-05T00:00:00Z", "modified": "2026-09-05T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-turn-hivemq-and-element-messenger-into-control-channels/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1547" } ], "labels": [ "T1021", "T1572", "T1102", "T1547" ] }, { "type": "threat-actor", "id": "threat-actor--d2ecf697-ab6c-5ea3-be10-82d1c3fcd291", "name": "Toy Ghouls", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-17T00:00:00Z", "modified": "2026-09-17T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/kaspersky-reports-three-clusters-targeting-russian-enterprises-n/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1078", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--25250113-b221-55de-a823-0a091d13357b", "name": "TraderTraitor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/suspected-tradertraitor-group-uses-trojanized-terraform-provider/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1195", "T1059", "T1105", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--3f2fa6f5-efed-5769-a9f9-2c812dcc462a", "name": "TraderTraitor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-weaponize-terraform-lock-files-to-infect-devops-engineer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1566", "T1195", "T1059", "T1573" ] }, { "type": "threat-actor", "id": "threat-actor--510ba1c3-84de-57cf-9abc-5c2c5f934c72", "name": "TraderTraitor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resur/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" } ], "labels": [ "T1566", "T1195", "T1583" ] }, { "type": "threat-actor", "id": "threat-actor--f5103b62-9772-5167-81c9-db7c7f9845e7", "name": "Tren de Aragua", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/tren-de-aragua-atm-jackpotting-scheme-used-malware-and-crypto-la/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--3ab10a11-7815-5357-822f-4c7a8c7c86da", "name": "Trinitite", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-tanstack-query-npm-package-to-steal-developer/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--7c9e6302-5f85-57bf-ac3a-9486ff6af8b2", "name": "UAC-0099", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-aligned-uac-0099-weaponized-ai-safety-guardrails-with-gua/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1059", "T1684", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--840e2c6d-835f-5b6f-af4b-3c386054d43b", "name": "UAC-0099", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/evolution-of-matchboil-downloader-by-uac-0099/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1193" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" } ], "labels": [ "T1193", "T1105", "T1027", "T1497" ] }, { "type": "threat-actor", "id": "threat-actor--d0feef29-1ab7-5cbb-8af2-04c7165418b5", "name": "UAC-0145", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--66e11c2a-d481-5970-9b7b-8b92911e65a7", "name": "UAC-0277", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-10T00:00:00Z", "modified": "2026-10-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cert-ua-100-websites-compromised-to-spread-lunex-stealer-via-fak/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1674" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1189", "T1674", "T1059", "T1555", "T1539" ] }, { "type": "threat-actor", "id": "threat-actor--0a4b5422-c641-5eef-a39c-8f539abb9330", "name": "UAT-11823", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--130bf6b8-6dc7-56b3-b28f-26d9bfd06cbc", "name": "UAT-11823 (Sandworm/GRU)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "threat-actor", "id": "threat-actor--335c6f88-7874-5c60-a8aa-58da6e6ccefc", "name": "UAT-11985", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-12T00:00:00Z", "modified": "2026-10-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-use-ai-generated-event-lures-to-steal-google-accounts-an/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1557" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" } ], "labels": [ "T1566", "T1656", "T1557", "T1539" ] }, { "type": "threat-actor", "id": "threat-actor--940b9625-fa1a-5e11-97f4-63aebe350f1e", "name": "UAT-11988", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--994b585a-2410-57b8-835f-0d259602e00b", "name": "UAT-11988 (Qilin)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "threat-actor", "id": "threat-actor--23f6335c-2a27-5392-a5e3-0808e642f29b", "name": "UAT-12197", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/active-exploitation-of-cisco-secure-firewall-management-center-v/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" }, { "source_name": "MITRE ATT&CK", "external_id": "T1021" } ], "labels": [ "T1190", "T1100", "T1059", "T1003", "T1021" ] }, { "type": "threat-actor", "id": "threat-actor--b7feded9-b0c0-5e3f-ae13-c5b8d820707d", "name": "UAT-12197", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisco-fmc-exploits-fuel-ransomware-apt-attacks-cisco-fmc-vulnera/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1003" } ], "labels": [ "T1190", "T1100", "T1059", "T1003" ] }, { "type": "threat-actor", "id": "threat-actor--9c5b4547-49cc-5795-8c0b-41d6dfeac6b0", "name": "UNC3569", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-15T00:00:00Z", "modified": "2026-09-15T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-unc3569-exploited-sogou-input-method-flaw-to-deploy/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" } ], "labels": [ "T1204", "T1059", "T1027" ] }, { "type": "threat-actor", "id": "threat-actor--db04d057-cbf9-5b55-8285-44db3af848d0", "name": "UNC3569", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-14T00:00:00Z", "modified": "2026-09-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1038" }, { "source_name": "MITRE ATT&CK", "external_id": "T1573" } ], "labels": [ "T1190", "T1059", "T1203", "T1038", "T1573" ] }, { "type": "threat-actor", "id": "threat-actor--00457c8c-2a6e-5dbe-b34e-e6c7c656a4cb", "name": "UNC4899", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/don-t-call-us-we-ll-call-your-apis-tradertraitor-backdoors-resur/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1583" } ], "labels": [ "T1566", "T1195", "T1583" ] }, { "type": "threat-actor", "id": "threat-actor--22f45ac5-0786-5515-904a-af5bfa7090bc", "name": "UNC5669", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-03T00:00:00Z", "modified": "2026-09-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-breach-brazilian-financial-firms-and-execute-hundreds-of/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1110", "T1566", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--256563c9-5fa2-53ab-89c0-7962fff19a8d", "name": "UNC5976", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--9b8ef77b-4f31-5c48-99a0-bd7e728b00c7", "name": "UNC5976", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--15637b4f-5682-54a3-8280-db3cb63e506e", "name": "UNC6240", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-30T00:00:00Z", "modified": "2026-09-30T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fbi-hackers-say-they-won-t-publish-massive-trove-of-fbi-employee/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" }, { "source_name": "MITRE ATT&CK", "external_id": "T1116" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1505", "T1116", "T1572", "T1219" ] }, { "type": "threat-actor", "id": "threat-actor--e8df9235-a0a4-5c24-a8da-05167c021ba0", "name": "UNC6240", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-have-apparently-breached-fbi-systems-and-have-extracted/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1491" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1219" } ], "labels": [ "T1190", "T1491", "T1005", "T1567", "T1219" ] }, { "type": "threat-actor", "id": "threat-actor--357bf853-d4eb-5d06-b8bb-21d5b59a2bcc", "name": "UNC6293", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--c839d54b-df44-58ca-8f42-d526d9ea1e5b", "name": "UNC6293", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--36a4f8fa-a44d-5f36-8cf1-19d8f746a4af", "name": "UNC6780", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-21T00:00:00Z", "modified": "2026-09-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/crowdsec-says-tanstack-npm-attack-led-to-copy-of-170-private-git/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1195", "T1552", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--4d1bef11-56c0-5f44-be71-aef4ff1537eb", "name": "UNC7005", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russia-linked-cyber-espionage-clusters-use-oauth-phishing-to-tar/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1539" }, { "source_name": "MITRE ATT&CK", "external_id": "T1185" } ], "labels": [ "T1566", "T1528", "T1621", "T1539", "T1185" ] }, { "type": "threat-actor", "id": "threat-actor--760d991e-155c-5d41-a42a-8f650ffaa653", "name": "UNC7005", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-21T00:00:00Z", "modified": "2026-08-21T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/russian-hackers-trick-academics-and-diplomats-into-giving-them-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1598" }, { "source_name": "MITRE ATT&CK", "external_id": "T1528" }, { "source_name": "MITRE ATT&CK", "external_id": "T1621" }, { "source_name": "MITRE ATT&CK", "external_id": "T1550" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1598", "T1528", "T1621", "T1550", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--a60ae29e-580e-5d82-86e1-619ba27c4ea2", "name": "UNKK", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-28T00:00:00Z", "modified": "2026-09-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/remcontrol-android-banking-trojan-steals-pins-using-ai-built-phi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1056" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1056", "T1113", "T1562", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--e6c2e48d-8fbb-5284-817b-5ae8e28616c8", "name": "UTA0533", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-11T00:00:00Z", "modified": "2026-08-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sonicwall-sma1000-two-zero-day-flaws-under-active-exploitation-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1068", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--45fe1b62-01f9-59dc-aa0b-8b54b6fbdd9b", "name": "UTA0560", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-apt-clones-legitimate-websites-to-deliver-chrome-and-win/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" } ], "labels": [ "T1195", "T1203", "T1608" ] }, { "type": "threat-actor", "id": "threat-actor--47a25f55-8efb-587f-bb9c-d23dab7114c1", "name": "UTA0560", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--64d1d124-7669-5abb-bd97-a34a6bf414cc", "name": "UTA0565", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-threat-actor-uta0565-chained-three-zero-days-chrome-cve/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1189", "T1203", "T1068", "T1204" ] }, { "type": "threat-actor", "id": "threat-actor--088e2c60-0d0e-566d-b7c5-0352a75ca2dd", "name": "Unattributed APT", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-14T00:00:00Z", "modified": "2026-08-14T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-exploit-critical-vmware-vcenter-flaw-to-deploy-reverse-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1190", "T1105", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--9889fcd6-68ce-5793-8d29-003fd1a357eb", "name": "Unattributed APT", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/critical-vmware-vcenter-directory-traversal-flaw-used-in-global/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" } ], "labels": [ "T1190", "T1059", "T1105", "T1572" ] }, { "type": "threat-actor", "id": "threat-actor--0dba3daf-f6aa-5890-b804-3a8875dc7df5", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/papercut-ng-mf-critical-zero-day-exploited-in-the-wild/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1505" } ], "labels": [ "T1190", "T1505" ] }, { "type": "threat-actor", "id": "threat-actor--2aee33fc-3bac-5b5d-be33-5f336bad7fec", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-use-fake-cloudflare-captcha-to-deploy-terminalfix-revers/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" }, { "source_name": "MITRE ATT&CK", "external_id": "T1027" }, { "source_name": "MITRE ATT&CK", "external_id": "T1105" } ], "labels": [ "T1566", "T1059", "T1204", "T1574", "T1027", "T1105" ] }, { "type": "threat-actor", "id": "threat-actor--4c53c6ed-69cb-5f6e-886a-59c6b7990550", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-29T00:00:00Z", "modified": "2026-08-29T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/critical-gogs-flaw-enables-remote-code-execution-through-path-tr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "threat-actor", "id": "threat-actor--60a0753b-5e74-5309-af80-4d586a22c974", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/sleepwalker-backdoor-uses-smb-icmp-dns-and-vmware-vmci-for-cover/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1095" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1572" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" } ], "labels": [ "T1095", "T1071", "T1572", "T1036", "T1055" ] }, { "type": "threat-actor", "id": "threat-actor--73248f7e-95db-5b20-ae54-085f0717f1b0", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/go-loader-uses-anti-sandbox-checks-and-snowlight-to-execute-file/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1497" }, { "source_name": "MITRE ATT&CK", "external_id": "T1620" } ], "labels": [ "T1566", "T1204", "T1059", "T1497", "T1620" ] }, { "type": "threat-actor", "id": "threat-actor--a8b8b9c7-9365-5e6c-ac02-fa2bb05b61b0", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/manchester-airports-group-says-hackers-stole-travelers-data/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--a9ceb178-a03d-5f6f-b8dd-b0cce8ad4197", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-target-litellm-ragflow-and-kestra-ai-infrastructure-to-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1190", "T1059", "T1552", "T1496", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--b10af340-d795-5da1-aa8a-8387b8da50a6", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/papercut-warns-of-ng-mf-flaw-exploited-in-zero-day-attacks/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" } ], "labels": [ "T1190" ] }, { "type": "threat-actor", "id": "threat-actor--bac3b414-dacf-54b4-b619-519ce2aad7eb", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/boston-scientific-says-cyberattack-disrupted-operations-globally/" } ], "labels": [] }, { "type": "threat-actor", "id": "threat-actor--bd10f1b6-3961-5aac-88d1-d1c6877156f7", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asos-links-data-breach-to-social-engineering-attack-credential-t/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1684" }, { "source_name": "MITRE ATT&CK", "external_id": "T1199" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" } ], "labels": [ "T1684", "T1199", "T1078" ] }, { "type": "threat-actor", "id": "threat-actor--c25de8d9-8d9c-543f-9e9a-3dca616a13d6", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-11T00:00:00Z", "modified": "2026-10-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/danish-cpr-data-breach-exposes-records-protected-by-weak-123456/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1213" } ], "labels": [ "T1078", "T1213" ] }, { "type": "threat-actor", "id": "threat-actor--da8631c3-df74-529e-bb0e-30cb4f160c48", "name": "Unknown", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/asos-data-breached-hackers-sent-users-threatening-messages/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1659" } ], "labels": [ "T1659" ] }, { "type": "threat-actor", "id": "threat-actor--aff2583a-2694-54c2-a91f-e8eb2b2c7f67", "name": "Unknown Chinese-speaking", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-28T00:00:00Z", "modified": "2026-08-28T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-speaking-hackers-exploit-known-flaws-to-steal-philippine/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1210" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1190", "T1210", "T1005", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--cf0fcd14-419f-5475-9524-838b4192ab2f", "name": "Unknown Chinese-speaking", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-11T00:00:00Z", "modified": "2026-10-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/artex-ai-claude-agents-used-in-cyberattacks-on-south-korean-bank/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1041" } ], "labels": [ "T1005", "T1041" ] }, { "type": "threat-actor", "id": "threat-actor--317bdeef-91eb-5349-9189-4bf248c614eb", "name": "Unnamed extortion actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-13T00:00:00Z", "modified": "2026-08-13T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/novo-nordisk-breach-two-separate-extortion-groups-demands-of-50m/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1078", "T1552", "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--7f6962dd-4b93-571e-8cec-590ca615de0b", "name": "Violet Typhoon", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/proofpoint-identified-bluemoon-an-exploit-kit-chaining-two-chrom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1189" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1189", "T1203", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--b02b3cb5-78d8-5f7a-a463-b0a70d376f0b", "name": "Violet Typhoon", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-12T00:00:00Z", "modified": "2026-09-12T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/china-linked-hackers-chain-chrome-zero-day-with-windows-kernel-f/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1555" }, { "source_name": "MITRE ATT&CK", "external_id": "T1082" } ], "labels": [ "T1566", "T1203", "T1068", "T1059", "T1555", "T1082" ] }, { "type": "threat-actor", "id": "threat-actor--69532ece-1161-5463-8d46-a8597728e853", "name": "Warlock", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-03T00:00:00Z", "modified": "2026-10-03T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/warlock-ransomware-breach-sharepoint-in-water-telecom-operator-a/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1100" }, { "source_name": "MITRE ATT&CK", "external_id": "T1089" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1190", "T1100", "T1089", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--4439af3c-c88c-52b2-a99c-5cb62642bd5c", "name": "Water Kurita", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-09T00:00:00Z", "modified": "2026-10-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/fakegit-campaign-7-600-malicious-github-repos-pushing-smartloade/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1608" }, { "source_name": "MITRE ATT&CK", "external_id": "T1036" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" } ], "labels": [ "T1608", "T1036", "T1204" ] }, { "type": "threat-actor", "id": "threat-actor--75da7df7-683c-55d6-bc00-2ddcf264d71e", "name": "WaterPlum", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-22T00:00:00Z", "modified": "2026-09-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/contagious-interview-north-korean-threat-actors-compromised-30-0/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1566", "T1204", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--76bdc78e-5aac-5349-9300-62fea0d6efd8", "name": "WaterPlum", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-19T00:00:00Z", "modified": "2026-09-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-linked-actors-are-targeting-tech-professionals-with/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1204" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1566", "T1204", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--db0d6afc-9e5f-5578-81dc-c7fbb1b608ad", "name": "WaterPlum", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1486" } ], "labels": [ "T1566", "T1195", "T1059", "T1005", "T1486" ] }, { "type": "threat-actor", "id": "threat-actor--d4e8da6f-e3de-5149-869d-d471fa47e406", "name": "WraithTools", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/x47-c-windows-botnet-weaponizes-xai-grok-ai-api-draining/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1568" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" }, { "source_name": "MITRE ATT&CK", "external_id": "T1503" }, { "source_name": "MITRE ATT&CK", "external_id": "T1562" }, { "source_name": "MITRE ATT&CK", "external_id": "T1496" } ], "labels": [ "T1568", "T1090", "T1503", "T1562", "T1496" ] }, { "type": "threat-actor", "id": "threat-actor--3c845411-b6a8-518d-a6e7-0c36dded4fde", "name": "Xu Zewei", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/u-s-offers-10-million-reward-for-chinese-hacker-behind-alleged-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--0f0abe05-4529-59c6-a378-c1b182aa9fe0", "name": "Z.AI", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-10T00:00:00Z", "modified": "2026-09-10T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/deepseek-alibaba-and-chinese-ai-firms-extract-billions-of-tokens/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" }, { "source_name": "MITRE ATT&CK", "external_id": "T1090" } ], "labels": [ "T1567", "T1071", "T1090" ] }, { "type": "threat-actor", "id": "threat-actor--552a86d6-61ea-5b44-878b-0877fa004e0a", "name": "Z.AI", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-09T00:00:00Z", "modified": "2026-09-09T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/feds-accuse-china-of-systematic-distillation-of-u-s-ai-models/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1682" }, { "source_name": "MITRE ATT&CK", "external_id": "T1589" } ], "labels": [ "T1682", "T1589" ] }, { "type": "threat-actor", "id": "threat-actor--3f3d62c7-f2f1-55b7-8474-76ff4affaaa5", "name": "ZeroBytes", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-19T00:00:00Z", "modified": "2026-08-19T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/french-tax-authority-data-breach-impacts-678-000-individuals-and/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1078", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--4c325c70-b4a3-5222-8074-c902e5657310", "name": "Zhang Yu", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-08T00:00:00Z", "modified": "2026-10-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/u-s-offers-10-million-reward-for-chinese-hacker-behind-alleged-c/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--de7f4f88-f59e-5803-b2cc-e2305f17b5a9", "name": "academic researchers (HKUST-GZ, PolyU)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/injecteave-attack-lets-attackers-eavesdrop-on-headphone-audio-fr/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" } ], "labels": [ "T1203" ] }, { "type": "threat-actor", "id": "threat-actor--fee0c99b-18b3-5469-be17-50424351864e", "name": "depthfirst", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-20T00:00:00Z", "modified": "2026-09-20T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/tiktok-users-cameras-hacked-with-open-weight-model-by-depthfirst/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1203" }, { "source_name": "MITRE ATT&CK", "external_id": "T1113" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1203", "T1113", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--351b8d68-6d52-5257-bea4-42459850ccee", "name": "iamnotavillain", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-18T00:00:00Z", "modified": "2026-09-18T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/revolut-data-breach-5-months-680-high-profile-accounts-3m-ransom/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1656" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1566", "T1656", "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--ab9e7787-8c8f-5793-b126-894e0aada1bc", "name": "kiberphant0m", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-27T00:00:00Z", "modified": "2026-09-27T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/former-us-soldier-sentenced-for-telecom-hacking-and-extortion-sp/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1110" }, { "source_name": "MITRE ATT&CK", "external_id": "T1078" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" }, { "source_name": "MITRE ATT&CK", "external_id": "T1657" } ], "labels": [ "T1110", "T1078", "T1567", "T1657" ] }, { "type": "threat-actor", "id": "threat-actor--51a6a4d8-ff54-50d4-b6cb-55f18c23bf7c", "name": "knaithe", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-08-22T00:00:00Z", "modified": "2026-08-22T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/chinese-hacker-uses-deepseek-ai-to-automate-vulnerability-exploi/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1595" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1595", "T1190", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--076c76f7-e08a-58e3-aa2c-c493d28f83c1", "name": "ransomware operators (unattributed)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-11T00:00:00Z", "modified": "2026-09-11T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/cisa-watchguard-rce-flaw-now-exploited-in-ransomware-attacks-htt/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" } ], "labels": [ "T1190", "T1059" ] }, { "type": "threat-actor", "id": "threat-actor--e4babb53-ba75-5874-b27d-7fe81cf4fd2a", "name": "unattributed AI agent", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-02T00:00:00Z", "modified": "2026-10-02T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/autonomous-ai-agent-breached-organization-using-two-zammad-zero/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" } ], "labels": [ "T1190", "T1068" ] }, { "type": "threat-actor", "id": "threat-actor--fe77dd0a-1b25-5eac-b58c-fc376410165d", "name": "unidentified researcher (Xusheng Li)", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/windows-attack-hijacks-trusted-security-apps-to-abuse-powerful-k/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1068" }, { "source_name": "MITRE ATT&CK", "external_id": "T1055" }, { "source_name": "MITRE ATT&CK", "external_id": "T1574" } ], "labels": [ "T1068", "T1055", "T1574" ] }, { "type": "threat-actor", "id": "threat-actor--724ab38f-c3b6-5030-a133-a0c1193ff441", "name": "unidentified threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/hackers-compromise-coder-module-registry-to-serve-malicious-pack/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1195" }, { "source_name": "MITRE ATT&CK", "external_id": "T1059" }, { "source_name": "MITRE ATT&CK", "external_id": "T1552" } ], "labels": [ "T1195", "T1059", "T1552" ] }, { "type": "threat-actor", "id": "threat-actor--a85abded-f2dd-59ff-804d-07a4b4eb124b", "name": "unidentified threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/bimbo-bakeries-usa-data-breach-exposes-ssns-in-oracle-e-business/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" }, { "source_name": "MITRE ATT&CK", "external_id": "T1567" } ], "labels": [ "T1190", "T1005", "T1567" ] }, { "type": "threat-actor", "id": "threat-actor--adf6e3cb-e745-55b6-bbea-a52d88cc0ac5", "name": "unidentified threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/global-phishing-campaign-abuses-google-infrastructure-to-evade-s/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1566" }, { "source_name": "MITRE ATT&CK", "external_id": "T1102" }, { "source_name": "MITRE ATT&CK", "external_id": "T1071" } ], "labels": [ "T1566", "T1102", "T1071" ] }, { "type": "threat-actor", "id": "threat-actor--c6e9e568-2f74-582a-9c5c-0e93590eff0b", "name": "unidentified threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-09-08T00:00:00Z", "modified": "2026-09-08T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/mathspace-discloses-data-breach-affecting-over-1-million-people/" }, { "source_name": "MITRE ATT&CK", "external_id": "T1190" }, { "source_name": "MITRE ATT&CK", "external_id": "T1005" } ], "labels": [ "T1190", "T1005" ] }, { "type": "threat-actor", "id": "threat-actor--d39cee67-9a98-56e9-a227-b9c6151400a7", "name": "unidentified threat actor", "threat_actor_types": [ "threat-actor" ], "spec_version": "2.1", "created": "2026-10-06T00:00:00Z", "modified": "2026-10-06T00:00:00Z", "external_references": [ { "source_name": "Tia N. List", "url": "https://zarguell.github.io/tia-n-list/cti/nueva-eps-colombia-s-largest-regional-healthcare-promoting-entit/" } ], "labels": [] } ] }