Public Export

What you see below are the top 50 entries associated with this search in the Orange Cyberdefense Datalake Threat Intelligence database.
You can download all results in a file in CSV format.

This view is limited, and more information is available with a commercial subscription to the Datalake service. With premium access you are able to see all events associated with an observable, additional intelligence data, DNS telemetry and more.

If you are interested in a premium access, please contact: info.cert@fr.orangecyberdefense.com

Showing: 50 threats out of: 294 results.

Download CSV with all results

THREAT: 253f3a53796f1b0fbe64f7b05ae1d66bc2b07...

atom details

File: 253f3a53796f1b0fbe64f7b05ae1d66bc2b07...

First seen: 31 Mar 2023, 14:05:35

Last updated by source: 31 Mar 2023, 14:05:35

Events: 1

Sources: 1

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: 172.105.26.167

atom details

IP: 172.105.26.167

First seen: 20 Jan 2023, 18:32:03

Last updated by source: 16 Aug 2023, 10:04:42

Events: 151

Sources: 4

Threat Entities:

Campaign: SmoothOperator

Location: France

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam 0

THREAT: 5407cda7d3a75e7b1e030b1f33337a56f2935...

atom details

File: 5407cda7d3a75e7b1e030b1f33337a56f2935...

First seen: 30 Mar 2023, 08:02:04

Last updated by source: 14 Apr 2023, 07:45:02

Events: 4

Sources: 3

Threat Entities:

Attack Pattern: Compromise Software Supply Chain - T1195.002

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: sourceslabs.com

atom details

Domain: sourceslabs.com

First seen: 24 Dec 2022, 12:26:35

Last updated by source: 18 Jul 2024, 00:32:55

Events: 290

Sources: 22

Threat Entities:

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: Domains - T1584.001

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: Exploitation for Privilege Escalation - T1068

Attack Pattern: Exploits - T1587.004

Attack Pattern: Exploits - T1588.005

Attack Pattern: Malware - T1587.001

Attack Pattern: Multi-Stage Channels - T1104

Attack Pattern: SMB/Windows Admin Shares - T1021.002

Campaign: SmoothOperator

Identity: Defense

Location: France

Location: Romania

Location: Turkey

Location: eastern-europe (victim)

Location: europe (victim)

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 0

Leak -

Malware 16

Phishing 19

Scan 1

Scam -

Spam -

THREAT: 2a22798543bd1f97dd5cd626ba9ac6de6d0a7...

atom details

File: 2a22798543bd1f97dd5cd626ba9ac6de6d0a7...

First seen: 31 Mar 2023, 14:51:33

Last updated by source: 31 Mar 2023, 14:51:33

Events: 1

Sources: 1

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: 769383fc65d1386dd141c960c9970114547da0c2

atom details

File: 769383fc65d1386dd141c960c9970114547da0c2

First seen: 30 Mar 2023, 13:58:21

Last updated by source: 30 Mar 2023, 15:38:18

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 24

Phishing 19

Scan -

Scam -

Spam -

THREAT: http://zacharryblogs.com

atom details

URL: http://zacharryblogs.com

First seen: 29 Mar 2023, 16:45:54

Last updated by source: 23 Apr 2024, 08:57:07

Events: 17

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 19

Phishing 17

Scan 0

Scam -

Spam -

THREAT: 19dbffec4e359a198daf4ffca1ab9165

atom details

File: 19dbffec4e359a198daf4ffca1ab9165

First seen: 31 Mar 2022, 14:43:34

Last updated by source: 24 Apr 2023, 10:09:13

Events: 6

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan 24

Scam -

Spam -

THREAT: 900b63ff9b06e0890bf642bdfcbfcc6ab7887...

atom details

File: 900b63ff9b06e0890bf642bdfcbfcc6ab7887...

First seen: 22 Apr 2023, 04:41:43

Last updated by source: 24 Apr 2023, 10:13:43

Events: 4

Sources: 3

Threat Entities:

Campaign: SmoothOperator

Identity: Energy

Location: United States of America

Location: americas (victim)

Location: north-america (victim)

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan -

Scam -

Spam -

THREAT: 103.48.83.86

atom details

IP: 103.48.83.86

First seen: 23 Feb 2023, 10:28:16

Last updated by source: 13 Oct 2023, 10:38:25

Events: 244

Sources: 12

Threat Entities:

Campaign: SmoothOperator

Location: France

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 0

Leak -

Malware 5

Phishing 5

Scan 0

Scam -

Spam 0

THREAT: https://sbmsa.wiki/blog/_insert

atom details

URL: https://sbmsa.wiki/blog/_insert

First seen: 31 Mar 2023, 13:10:10

Last updated by source: 01 Dec 2023, 11:04:54

Events: 15

Sources: 8

Threat Entities:

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: Domains - T1584.001

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: Exploitation for Privilege Escalation - T1068

Attack Pattern: Exploits - T1587.004

Attack Pattern: Exploits - T1588.005

Attack Pattern: Malware - T1587.001

Attack Pattern: Multi-Stage Channels - T1104

Attack Pattern: SMB/Windows Admin Shares - T1021.002

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 2

Phishing 1

Scan -

Scam -

Spam -

THREAT: 19442d9e476e3ef990ce57b683190301e946c...

atom details

File: 19442d9e476e3ef990ce57b683190301e946c...

First seen: 22 Apr 2023, 04:41:43

Last updated by source: 25 Apr 2023, 12:31:05

Events: 6

Sources: 4

Threat Entities:

Campaign: SmoothOperator

Identity: Energy

Location: United States of America

Location: americas (victim)

Location: north-america (victim)

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan -

Scam -

Spam -

THREAT: aad815e0faf70063e39fb61d8dee107d

atom details

File: aad815e0faf70063e39fb61d8dee107d

First seen: 03 Apr 2023, 08:35:39

Last updated by source: 28 Nov 2023, 10:12:59

Events: 357

Sources: 1

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: http://journalide.org

atom details

URL: http://journalide.org

First seen: 29 Mar 2023, 06:46:26

Last updated by source: 25 Jul 2024, 01:07:43

Events: 156

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 36

Phishing 54

Scan -

Scam -

Spam -

THREAT: d459aa0a63140ccc647e9026bfd1fccd4c310...

atom details

File: d459aa0a63140ccc647e9026bfd1fccd4c310...

First seen: 31 Mar 2023, 13:51:25

Last updated by source: 31 Mar 2023, 14:42:00

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: 8875568b90bb03ff54d63d3bd1187063

atom details

File: 8875568b90bb03ff54d63d3bd1187063

First seen: 03 Apr 2023, 08:29:05

Last updated by source: 28 Nov 2023, 10:14:40

Events: 396

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: https://raw.githubusercontent.com/Ico...

atom details

URL: https://raw.githubusercontent.com/Ico...

First seen: 30 Mar 2023, 10:47:48

Last updated by source: 04 Apr 2023, 10:15:09

Events: 6

Sources: 4

Threat Entities:

Campaign: SmoothOperator

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 3

Phishing 1

Scan -

Scam -

Spam -

THREAT: https://officestoragebox.com/api/biosync

atom details

URL: https://officestoragebox.com/api/biosync

First seen: 30 Mar 2023, 15:38:18

Last updated by source: 01 Dec 2023, 11:04:54

Events: 71

Sources: 11

Threat Entities:

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: Domains - T1584.001

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: Exploitation for Privilege Escalation - T1068

Attack Pattern: Exploits - T1587.004

Attack Pattern: Exploits - T1588.005

Attack Pattern: Malware - T1587.001

Attack Pattern: Multi-Stage Channels - T1104

Attack Pattern: SMB/Windows Admin Shares - T1021.002

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 1

Phishing 1

Scan 3

Scam -

Spam -

THREAT: dde03348075512796241389dfea5560c20a3d...

atom details

File: dde03348075512796241389dfea5560c20a3d...

First seen: 30 Mar 2023, 08:02:04

Last updated by source: 14 Apr 2023, 07:45:02

Events: 4

Sources: 3

Threat Entities:

Attack Pattern: Compromise Software Supply Chain - T1195.002

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: 20d554a80d759c50d6537dd7097fed84dd258b3e

atom details

File: 20d554a80d759c50d6537dd7097fed84dd258b3e

First seen: 29 Mar 2023, 23:07:44

Last updated by source: 30 Mar 2023, 07:58:52

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 24

Phishing 19

Scan -

Scam -

Spam -

THREAT: http://www.tradingtechnologies.com

atom details

URL: http://www.tradingtechnologies.com

First seen: 17 Jun 2012, 17:40:24

Last updated by source: 26 Sep 2023, 12:47:53

Events: 12

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing 16

Scan -

Scam -

Spam -

THREAT: apollo-crypto.org.shilaerc20.com

atom details

FQDN: apollo-crypto.org.shilaerc20.com

First seen: 04 Apr 2023, 10:16:05

Last updated by source: 24 May 2023, 14:07:10

Events: 7

Sources: 6

Threat Entities:

Attack Pattern: Application Layer Protocol - T1071

Attack Pattern: Asymmetric Cryptography - T1573.002

Attack Pattern: Clear Windows Event Logs - T1070.001

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: DLL Side-Loading - T1574.002

Attack Pattern: DNS - T1071.004

Attack Pattern: Data Manipulation - T1565

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Deobfuscate/Decode Files or Information - T1140

Attack Pattern: Digital Certificates - T1588.004

Attack Pattern: Encrypted Channel - T1573

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: File Deletion - T1070.004

Attack Pattern: File and Directory Discovery - T1083

Attack Pattern: Hijack Execution Flow - T1574

Attack Pattern: Indicator Removal - T1070

Attack Pattern: Ingress Tool Transfer - T1105

Attack Pattern: Install Digital Certificate - T1608.003

Attack Pattern: Invalid Code Signature - T1036.001

Attack Pattern: Masquerading - T1036

Attack Pattern: Modify Registry - T1112

Attack Pattern: Obfuscated Files or Information - T1027

Attack Pattern: Obtain Capabilities - T1588

Attack Pattern: Process Injection - T1055

Attack Pattern: Query Registry - T1012

Attack Pattern: Reflective Code Loading - T1620

Attack Pattern: Stage Capabilities - T1608

Attack Pattern: Stored Data Manipulation - T1565.001

Attack Pattern: Supply Chain Compromise - T1195

Attack Pattern: System Checks - T1497.001

Attack Pattern: System Information Discovery - T1082

Attack Pattern: System Language Discovery - T1614.001

Attack Pattern: System Location Discovery - T1614

Attack Pattern: Virtualization/Sandbox Evasion - T1497

Attack Pattern: Web Protocols - T1071.001

Campaign: SmoothOperator

Location: France

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS 0

Fraud 0

Hack 0

Leak 0

Malware 100

Phishing 0

Scan 2

Scam 0

Spam 0

THREAT: 4e8482c112e04b5d2acf7a8fb3f3b07d

atom details

File: 4e8482c112e04b5d2acf7a8fb3f3b07d

First seen: 01 Apr 2023, 18:14:15

Last updated by source: 28 Nov 2023, 10:16:35

Events: 387

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 12

Phishing -

Scan -

Scam -

Spam -

THREAT: a3ccc48db9eabfed7245ad6e3a5b203f

atom details

File: a3ccc48db9eabfed7245ad6e3a5b203f

First seen: 21 Apr 2023, 14:31:14

Last updated by source: 24 Apr 2023, 10:09:15

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan 24

Scam -

Spam -

THREAT: 83cba55f180b0c100935137615e8d296

atom details

File: 83cba55f180b0c100935137615e8d296

First seen: 30 Mar 2023, 20:52:40

Last updated by source: 28 Nov 2023, 10:14:38

Events: 30

Sources: 5

Threat Entities:

Attack Pattern: Kerberoasting - T1558.003

Attack Pattern: OS Credential Dumping - T1003

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 23

Phishing -

Scan -

Scam -

Spam -

THREAT: http://qwepoi123098.com

atom details

URL: http://qwepoi123098.com

First seen: 29 Mar 2023, 12:03:51

Last updated by source: 13 Jul 2024, 22:28:36

Events: 22

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 19

Phishing 17

Scan 0

Scam -

Spam -

THREAT: 103.163.220.196

atom details

IP: 103.163.220.196

First seen: 03 Apr 2023, 16:00:15

Last updated by source: 28 May 2024, 16:32:11

Events: 143

Sources: 4

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 9

Phishing 5

Scan 1

Scam -

Spam -

THREAT: 268d4e399dbbb42ee1cd64d0da72c57214ac9...

atom details

File: 268d4e399dbbb42ee1cd64d0da72c57214ac9...

First seen: 31 Mar 2023, 14:42:24

Last updated by source: 31 Mar 2023, 15:13:21

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: http://pbxsources.com

atom details

URL: http://pbxsources.com

First seen: 29 Mar 2023, 06:46:55

Last updated by source: 13 Jul 2024, 22:28:25

Events: 110

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud 0

Hack 1

Leak 0

Malware 20

Phishing 18

Scan 0

Scam 0

Spam 0

THREAT: 103.118.244.131

atom details

IP: 103.118.244.131

First seen: 22 Mar 2023, 05:32:16

Last updated by source: 21 Dec 2023, 12:32:22

Events: 170

Sources: 4

Threat Entities:

Attack Pattern: Exploit Public-Facing Application - T1190

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 20

Phishing 0

Scan -

Scam -

Spam -

THREAT: 185.31.160.50

atom details

IP: 185.31.160.50

First seen: 11 Feb 2023, 22:32:20

Last updated by source: 16 Aug 2023, 10:05:41

Events: 171

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 0

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam -

THREAT: 9a54e95723b018e2851d8d151a596bf5

atom details

File: 9a54e95723b018e2851d8d151a596bf5

First seen: 31 Mar 2023, 18:42:04

Last updated by source: 28 Nov 2023, 10:13:09

Events: 361

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 12

Phishing -

Scan -

Scam -

Spam -

THREAT: 178.176.209.226

atom details

IP: 178.176.209.226

First seen: 17 Aug 2021, 13:20:03

Last updated by source: 16 Aug 2023, 10:05:48

Events: 1123

Sources: 12

Threat Entities:

Campaign: SmoothOperator

Location: Australia

Location: Canada

Location: Finland

Location: France

Location: Germany

Location: India

Location: Ireland

Location: Japan

Location: Netherlands

Location: Poland

Location: Romania

Location: Russian Federation

Location: Singapore

Location: Switzerland

Location: United Kingdom of Great Britain and Northern Ireland

Location: United States of America

Location: americas (victim)

Location: asia (victim)

Location: australia-newzealand (victim)

Location: east-asia (victim)

Location: eastern-europe (victim)

Location: europe (victim)

Location: north-america (victim)

Location: northern-europe (victim)

Location: oceania (victim)

Location: south-eastern-asia (victim)

Location: southern-asia (victim)

Location: western-europe (victim)

Malware: Mirai

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 0

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam 0

THREAT: 2e020a70248abae9b8ddcd756b6772bb

atom details

File: 2e020a70248abae9b8ddcd756b6772bb

First seen: 20 Jul 2022, 10:46:08

Last updated by source: 20 Jul 2023, 19:26:34

Events: 21

Sources: 11

Threat Entities:

Attack Pattern: Native API - T1106

Attack Pattern: Query Registry - T1012

Attack Pattern: Software Packing - T1027.002

Campaign: SmoothOperator

Identity: Construction

Identity: Energy

Location: China

Location: Italy

Location: United Arab Emirates

Location: United States of America

Location: americas (victim)

Location: asia (victim)

Location: east-asia (victim)

Location: europe (victim)

Location: middle-east (victim)

Location: north-america (victim)

Location: southern-europe (victim)

Location: west-asia (victim)

Malware: NukeSped

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 100

Phishing -

Scan -

Scam -

Spam -

THREAT: 23.118.207.106

atom details

IP: 23.118.207.106

First seen: 28 Jan 2023, 22:25:04

Last updated by source: 16 Aug 2023, 10:05:52

Events: 159

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 0

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam -

THREAT: 38.59.230.102

atom details

IP: 38.59.230.102

First seen: 30 Mar 2023, 10:32:39

Last updated by source: 16 Aug 2023, 10:05:55

Events: 146

Sources: 3

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 1

Phishing -

Scan -

Scam -

Spam -

THREAT: 172.93.201.88

atom details

IP: 172.93.201.88

First seen: 29 Mar 2023, 23:07:44

Last updated by source: 28 Dec 2023, 11:47:05

Events: 57

Sources: 13

Threat Entities:

Attack Pattern: Application Layer Protocol - T1071

Attack Pattern: Asymmetric Cryptography - T1573.002

Attack Pattern: Clear Windows Event Logs - T1070.001

Attack Pattern: Cloud Accounts - T1585.003

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: Create Process with Token - T1134.002

Attack Pattern: DLL Side-Loading - T1574.002

Attack Pattern: DNS - T1071.004

Attack Pattern: Data Manipulation - T1565

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Deobfuscate/Decode Files or Information - T1140

Attack Pattern: Digital Certificates - T1588.004

Attack Pattern: Domains - T1584.001

Attack Pattern: Embedded Payloads - T1027.009

Attack Pattern: Encrypted Channel - T1573

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: File Deletion - T1070.004

Attack Pattern: File and Directory Discovery - T1083

Attack Pattern: Hijack Execution Flow - T1574

Attack Pattern: Impair Command History Logging - T1562.003

Attack Pattern: Indicator Removal - T1070

Attack Pattern: Ingress Tool Transfer - T1105

Attack Pattern: Install Digital Certificate - T1608.003

Attack Pattern: Invalid Code Signature - T1036.001

Attack Pattern: Malicious File - T1204.002

Attack Pattern: Malware - T1587.001

Attack Pattern: Masquerading - T1036

Attack Pattern: Modify Registry - T1112

Attack Pattern: Obfuscated Files or Information - T1027

Attack Pattern: Obtain Capabilities - T1588

Attack Pattern: Process Injection - T1055

Attack Pattern: Proxy - T1090

Attack Pattern: Query Registry - T1012

Attack Pattern: Reflective Code Loading - T1620

Attack Pattern: Social Media - T1593.001

Attack Pattern: Spearphishing Link - T1566.002

Attack Pattern: Stage Capabilities - T1608

Attack Pattern: Standard Encoding - T1132.001

Attack Pattern: Stored Data Manipulation - T1565.001

Attack Pattern: Supply Chain Compromise - T1195

Attack Pattern: Symmetric Cryptography - T1573.001

Attack Pattern: System Checks - T1497.001

Attack Pattern: System Information Discovery - T1082

Attack Pattern: System Language Discovery - T1614.001

Attack Pattern: System Location Discovery - T1614

Attack Pattern: Time Based Evasion - T1497.003

Attack Pattern: Unix Shell Configuration Modification - T1546.004

Attack Pattern: Upload Malware - T1608.001

Attack Pattern: Virtualization/Sandbox Evasion - T1497

Attack Pattern: Web Protocols - T1071.001

Campaign: SmoothOperator

Malware: BADCALL - S0245

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: Simplesea

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 100

Phishing 8

Scan 1

Scam -

Spam -

THREAT: 202.146.220.196

atom details

IP: 202.146.220.196

First seen: 30 Mar 2023, 10:32:40

Last updated by source: 16 Aug 2023, 10:05:59

Events: 146

Sources: 3

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 1

Phishing -

Scan -

Scam -

Spam -

THREAT: f47c883f59a4802514c57680de3f41f690871...

atom details

File: f47c883f59a4802514c57680de3f41f690871...

First seen: 31 Mar 2023, 13:51:26

Last updated by source: 31 Mar 2023, 14:42:24

Events: 2

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan -

Scam -

Spam -

THREAT: 210.245.91.74

atom details

IP: 210.245.91.74

First seen: 02 Feb 2023, 18:34:17

Last updated by source: 16 Aug 2023, 10:06:06

Events: 160

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 0

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam 0

THREAT: https://azureonlinestorage.com/azure/storage

atom details

URL: https://azureonlinestorage.com/azure/storage

First seen: 30 Mar 2023, 03:17:26

Last updated by source: 06 May 2023, 08:42:07

Events: 11

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 2

Phishing 2

Scan 3

Scam -

Spam -

THREAT: http://glcloudservice.com/v1/console

atom details

URL: http://glcloudservice.com/v1/console

First seen: 29 Mar 2023, 12:16:18

Last updated by source: 23 Apr 2024, 16:51:47

Events: 10

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 18

Phishing 16

Scan 3

Scam -

Spam -

THREAT: 174.137.53.216

atom details

IP: 174.137.53.216

First seen: 21 Mar 2023, 14:32:57

Last updated by source: 16 Aug 2023, 10:06:16

Events: 152

Sources: 4

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack -

Leak -

Malware 1

Phishing -

Scan 0

Scam -

Spam -

THREAT: c6441c961dcad0fe127514a918eaabd4

atom details

File: c6441c961dcad0fe127514a918eaabd4

First seen: 21 Apr 2023, 14:31:14

Last updated by source: 17 Mar 2024, 19:00:15

Events: 5

Sources: 5

Threat Entities:

Attack Pattern: Application Layer Protocol - T1071

Attack Pattern: Asymmetric Cryptography - T1573.002

Attack Pattern: Clear Windows Event Logs - T1070.001

Attack Pattern: Compromise Software Supply Chain - T1195.002

Attack Pattern: DLL Side-Loading - T1574.002

Attack Pattern: DNS - T1071.004

Attack Pattern: Data Manipulation - T1565

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Deobfuscate/Decode Files or Information - T1140

Attack Pattern: Digital Certificates - T1588.004

Attack Pattern: Encrypted Channel - T1573

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: File Deletion - T1070.004

Attack Pattern: File and Directory Discovery - T1083

Attack Pattern: Hijack Execution Flow - T1574

Attack Pattern: Indicator Removal - T1070

Attack Pattern: Ingress Tool Transfer - T1105

Attack Pattern: Install Digital Certificate - T1608.003

Attack Pattern: Invalid Code Signature - T1036.001

Attack Pattern: Masquerading - T1036

Attack Pattern: Modify Registry - T1112

Attack Pattern: Obfuscated Files or Information - T1027

Attack Pattern: Obtain Capabilities - T1588

Attack Pattern: Process Injection - T1055

Attack Pattern: Query Registry - T1012

Attack Pattern: Reflective Code Loading - T1620

Attack Pattern: Stage Capabilities - T1608

Attack Pattern: Stored Data Manipulation - T1565.001

Attack Pattern: Supply Chain Compromise - T1195

Attack Pattern: System Checks - T1497.001

Attack Pattern: System Information Discovery - T1082

Attack Pattern: System Language Discovery - T1614.001

Attack Pattern: System Location Discovery - T1614

Attack Pattern: Virtualization/Sandbox Evasion - T1497

Attack Pattern: Web Protocols - T1071.001

Campaign: SmoothOperator

Malware: COLDCAT

Malware: IconicStealer

Malware: POOLRAT

Malware: SIGFLIP

Malware: TAXHAUL

Malware: VEILEDSIGNAL

Malware: Veiledsignal

Malware: sRDI

Threat Actor: APT43

Threat Actor: Citrine Sleet

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: VELVET CHOLLIMA (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan 24

Scam -

Spam -

THREAT: 63ebd0af18b22162a31f11446efc11cb

atom details

File: 63ebd0af18b22162a31f11446efc11cb

First seen: 30 Mar 2023, 10:20:17

Last updated by source: 28 Nov 2023, 10:14:34

Events: 235

Sources: 3

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 17

Phishing -

Scan -

Scam -

Spam -

THREAT: https://sourceslabs.com/downloads

atom details

URL: https://sourceslabs.com/downloads

First seen: 29 Mar 2023, 20:27:01

Last updated by source: 28 Nov 2023, 10:15:08

Events: 275

Sources: 6

Threat Entities:

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 2

Phishing 1

Scan 1

Scam -

Spam -

THREAT: 186.211.1.7

atom details

IP: 186.211.1.7

First seen: 20 Jul 2022, 23:15:16

Last updated by source: 03 Feb 2024, 07:23:40

Events: 4194

Sources: 23

Threat Entities:

Campaign: SmoothOperator

Location: Canada

Location: Estonia

Location: Finland

Location: France

Location: Germany

Location: Ireland

Location: Japan

Location: Netherlands

Location: Poland

Location: Singapore

Location: Spain

Location: United Kingdom of Great Britain and Northern Ireland

Location: United States of America

Location: americas (victim)

Location: asia (victim)

Location: east-asia (victim)

Location: eastern-europe (victim)

Location: europe (victim)

Location: north-america (victim)

Location: northern-europe (victim)

Location: south-eastern-asia (victim)

Location: southern-europe (victim)

Location: western-europe (victim)

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS 0

Fraud -

Hack 1

Leak -

Malware 1

Phishing 0

Scan 0

Scam -

Spam 0

THREAT: 2fdf61fdfd649f8bbf5730307a0ab5d1

atom details

File: 2fdf61fdfd649f8bbf5730307a0ab5d1

First seen: 04 Jan 2023, 00:00:00

Last updated by source: 12 Mar 2024, 18:31:50

Events: 315

Sources: 5

Threat Entities:

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 26

Leak -

Malware 35

Phishing 26

Scan 24

Scam -

Spam -

THREAT: https://officestoragebox.com/api/session

atom details

URL: https://officestoragebox.com/api/session

First seen: 30 Mar 2023, 05:26:53

Last updated by source: 27 Jun 2024, 05:07:10

Events: 43

Sources: 8

Threat Entities:

Campaign: SmoothOperator

Identity: Defense

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 19

Phishing 16

Scan 3

Scam -

Spam -

THREAT: 644f63f869e2b0a9e5d1aa32823956cc

atom details

File: 644f63f869e2b0a9e5d1aa32823956cc

First seen: 03 Apr 2023, 08:33:55

Last updated by source: 28 Nov 2023, 10:16:32

Events: 340

Sources: 2

Threat Entities:

Campaign: SmoothOperator

Threat Actor: LABYRINTH CHOLLIMA

Threat Actor: Lazarus (umbrella)

Scores:

DDoS -

Fraud -

Hack 24

Leak -

Malware 24

Phishing 19

Scan 22

Scam -

Spam -