{
    "type": "bundle",
    "id": "bundle--2b6d9251-b1ad-4d9b-8277-0073cc0b6d1e",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2023-03-08T12:51:43.216431Z",
            "modified": "2023-03-16T12:47:56.421112Z",
            "name": "SEKOIA",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
            "value": "104.168.167.88"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--773c479e-a07d-48fb-8e69-8b77d5e1c37e",
            "hashes": {
                "MD5": "f90b544f89cfbe38aee18024d7c39e40",
                "SHA-1": "182760cbe11fa0316abfb8b7b00b63f83159f5aa",
                "SHA-256": "9ca914b1cfa8c0ba021b9e00bda71f36cad132f27cf16bda6d937badee66c747"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--847c0496-d4d7-4e6c-8a0a-8f031c37332e",
            "hashes": {
                "MD5": "352715d5770b53768bf9f23d810ad55f",
                "SHA-1": "831dc7bc4a234907d94a889bcb60b7bedf1a1e13",
                "SHA-256": "7fccc871c889a4f4c13a977fdd5f062d6de23c3ffd27e72661c986fae6370387"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3464221c-21aa-4230-85cd-338c70c6bdb3",
            "hashes": {
                "MD5": "e2699d59c3602893698c5958f485c6c2",
                "SHA-1": "3cc19cef767dee93588525c74fe9c1f1bf6f8007",
                "SHA-256": "ec8f97d5595d92ec678ffbf5ae1f60ce90e620088927f751c76935c46aa7dc41"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a6281ae2-3320-4630-a951-87f787db85e1",
            "hashes": {
                "MD5": "9665d42cd8c9ef7b513baaf15e049218",
                "SHA-1": "5304031dc990790a26184b05b3019b2c5fa7022a",
                "SHA-256": "3b6f30369a4ee8bf9409d141b6d1b3fb4286c34984b5de005ed7431df549b17e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0665a39a-1473-48cd-a3f1-1b0245a085b8",
            "hashes": {
                "MD5": "91d9e9c090f8b0058d0435e7b3732f9e",
                "SHA-1": "7f8f43326f1ce505a8cd9f469a2ded81fa5c81be",
                "SHA-256": "5f00106f7f15e0ca00df4dbb0eeccd57930b4b81bc9aa3fca0c5af4eda339ab7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--808a55bb-eb2e-45bc-8278-0286ec19be35",
            "hashes": {
                "MD5": "5dcf7c3e8f2426aa997f36ce4fff8314",
                "SHA-1": "89301dfdc5361f1650796fecdac30b7d86c65122",
                "SHA-256": "83f457bc81514ec5e3ea123fc237811a36da6ce7f975ad56d62e34af4d1f37c0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--73f460b8-47ec-47d4-9997-92a5216feb12",
            "hashes": {
                "MD5": "424e5dd088121e366d96f3227aea7af2",
                "SHA-1": "5933f1a20117d48985b60b10b5e42416ac00e018",
                "SHA-256": "dda8a9e2a2e415be781a39fdf41f1551af2344f1b1a0ddf921d8aeba90343d1b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--757eb651-5545-4811-abc6-ccd5b9757532",
            "hashes": {
                "MD5": "6b04101ac3631e7f526901266dc807f1",
                "SHA-1": "d9f1392fb7ed010a0ecc4f819782c179efde9687",
                "SHA-256": "0d6964fe763c2e6404cde68af2c5f86d34cf50a88bd81bc06bba739010821db0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--db2b7dd0-0c96-4e14-a48d-f2f0b373c971",
            "hashes": {
                "MD5": "89bf69c99b92524189b5af980eeb68b1",
                "SHA-1": "d5971e8a3e8577dbb6f5a9aad248c842a33e7a26",
                "SHA-256": "d6d367453c513445313be7339666e4faeeebeae71620c187012ea5ae2901df34"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f54c9af8-d63e-4e68-a868-28e5b23cba86",
            "hashes": {
                "MD5": "19d3db82d16942b3c338439a36f20453",
                "SHA-1": "dabb4372050264f389b8adcf239366860662ac52",
                "SHA-256": "7c66d2d75be43d2c17e75d37c39344a9b5d29ee5c5861f178aa7d9f34208eb48"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d05478da-13f2-4132-9117-3b03ec09f682",
            "hashes": {
                "MD5": "22574a67e1514831e021bd1cb7e4ffbd",
                "SHA-1": "9121509d674091ce1f5f30e9a372b5dcf9bcd257",
                "SHA-256": "ea5fac3201a09c3c5c3701723ea9a5fec8bbc4f1f236463d651303f40a245452"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e92a0147-fc87-423f-80b2-90d707212bc7",
            "hashes": {
                "MD5": "0454b399ff8055ab2d949763e8add747",
                "SHA-1": "963a86aab1e450b03d51628797572fe9da8410a2",
                "SHA-256": "46db9f2fc879bf643a8f05e2b35879b235cbb04aa06fe548f0bc7c7c02483cf3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d4b5dff9-3d00-4468-b146-9b869ad9ddfd",
            "hashes": {
                "MD5": "bc0d533a89e7994909edb210fa367ede",
                "SHA-1": "27b101707b958139c32388eb4fd79fcd133ed880",
                "SHA-256": "e2f177b8806923f21a93952b61aedbeb02d829a67a820a7aab5ee72512e3d646"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7b0ad354-1a8b-4153-b645-f815388aa001",
            "hashes": {
                "MD5": "407decd1a87626287603f2f07152647d",
                "SHA-1": "9676f0758c8e8d0e0d203c75b922bcd0aeaa0873",
                "SHA-256": "c28e4031129f3e6e5c6fbd7b1cebd8dd21b6f87a8564b0fb9ee741a9b8bc0197"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--46e9b213-5f43-49b4-857a-3dc300a1e692",
            "hashes": {
                "MD5": "f562b5c534b1979af06159ce65920bdd",
                "SHA-1": "a1a85cba1bc4ac9f6eafc548b1454f57b4dff7e0",
                "SHA-256": "b448381f244dc0072abd4f52e01ca93efaebb2c0a8ea8901c4725ecb1b2b0656"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--19096ff6-36bb-40ae-9340-2fcf960c060c",
            "hashes": {
                "MD5": "1c7d23ab18ea9d940eca730756975873",
                "SHA-1": "338af1d91b846f2238d5a518f951050f90693488",
                "SHA-256": "3f0d5ddca2657044f4763ae53c4f33c8a7814ba451b60d24430a126674125624"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b261a9ff-a3d6-42b1-b602-2c91d483e266",
            "hashes": {
                "MD5": "15166ba6354f410fa7c7b6b4ecd70340",
                "SHA-1": "9a5f6a641cc170435f52c6a759709a62ad5757c7",
                "SHA-256": "61772375af1884fe73c5d154b8637dd62f26d23bc38d18462a88e2bbed483fd7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cd739a7f-c13e-4697-b335-4e47c2832ff9",
            "hashes": {
                "MD5": "3e1db8065824f659baeb0e826ad71086",
                "SHA-1": "be234cb6819039d6a1d3b1a205b9f74b6935bbcc",
                "SHA-256": "07d206664a8d397273e69ce37ef7cf933c22e93b62d95b673d6e835876feba06"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9b06bd00-96cc-44ec-9cf7-d5ee245706f3",
            "hashes": {
                "MD5": "d6d32d51272c4651c46758642215a1fc",
                "SHA-1": "0738687206a88ecbee176e05e0518effa4ca4166",
                "SHA-256": "b68bf400a23b1053f54911a2b826d341f6bf87c26bea5e6cf21710ee569a7aab"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3c2feb23-96ba-445e-b54a-f9f5cf0e98e9",
            "hashes": {
                "MD5": "fd5d532053e0ecb89e589a1024ae791e",
                "SHA-1": "7e1870a5b24c78a5e357568969aae3a5e7ab857d",
                "SHA-256": "6ca3a2f4cef27dac9d28c1ec2b29a8fa09dfc6dbbaf58e00dddbf5c1dd3b3cc3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--767056cd-cf09-4fce-9d75-0372f8f18873",
            "hashes": {
                "MD5": "12529a0e7102d9dc87664f631e489a0a",
                "SHA-1": "e2bcdfbda85c55a4d6070c18723ba4adb7631807",
                "SHA-256": "ff8832355ae99ffd66d0fe9eda2d74efdf3ed87bb2a4c215b93ade93165f7c0b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9f51f5f7-19fd-4e19-ab01-8524e9126e5b",
            "hashes": {
                "MD5": "63e898d9281201472701e64e32695016",
                "SHA-1": "574bbb76ef147b95dfdf11069aaaa90df968e542",
                "SHA-256": "ebad7317e1b01c2231bdbf37dfebdf656e3c8706e719fd37b66f0170b3d5cae0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fd609ebc-2602-4f27-9647-6d05c19d39cd",
            "hashes": {
                "MD5": "b93d7b7b30207249c1c683df16bad107",
                "SHA-1": "fd1cef5abe3e0c275671916a1f3a566f13489416",
                "SHA-256": "bea33fb3205319868784c028418411ee796d6ee3dfe9309f143e7e8106116a49"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f2036c53-1a66-4d35-885a-f3ac3ed20369",
            "hashes": {
                "MD5": "b961ec199c455a34892c19c61616e4ae",
                "SHA-1": "469236d0054a270e117a2621f70f2a494e7fb823",
                "SHA-256": "8e234482db790fa0a3d2bf5f7084ec4cfb74bffd5f6cbdc5abdbc1350f58e3fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--aaa4bcf5-4eb0-4e22-81a1-47497af4f04b",
            "hashes": {
                "MD5": "606bce13161693844b9eb36c96554883",
                "SHA-1": "72167ec09d62cdfb04698c3f96a6131dceb24a9c",
                "SHA-256": "38106b043ede31a66596299f17254d3f23cbe1f983674bf9ead5006e0f0bf880"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2ed870ce-c645-4968-8185-ae78ee7a84de",
            "hashes": {
                "MD5": "13865811ce54416bb7dde6ae4807b1b6",
                "SHA-1": "7a5d57c7e2b0c8ab7d60f7a7c7f4649f33fea8aa",
                "SHA-256": "c56a97efd6d3470e14193ac9e194fa46d495e3dddc918219cca530b90f01d11e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--740d9476-8885-4074-b353-6c241f9c80ae",
            "hashes": {
                "MD5": "ca86579220eecfaede268d1520d07fae",
                "SHA-1": "ac08406818bbf4fe24ea04bfd72f747c89174bdb",
                "SHA-256": "7981ebf35b5eff8be2f3849c8f3085b9cec10d9759ff4d3afd46990520de0407"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2508205f-86e1-40d7-aca2-ede13dc9c70f",
            "hashes": {
                "MD5": "f8800dd176487601ccf2e27c094b297b",
                "SHA-1": "e0e42ac374443500c236721341612865cd3d1eec",
                "SHA-256": "e74e8cdf887ae2de25590c55cb52dad66f0135ad4a1df224155f772554ea970c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4831b205-3bf0-4249-a3c7-77939e77f035",
            "hashes": {
                "MD5": "9676cd8462dc557a07d91e7bee108916",
                "SHA-1": "ca59874172660e6180af2815c3a42c85169aa0b2",
                "SHA-256": "9525f5081a5a7ab7d35cf2fb2d7524e0777e37fe3df62730e1e7de50506850f7"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--eba1efb6-356e-4389-8bfd-14352610d9cb",
            "value": "104.255.172.56"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ac082f62-1f8b-4a2e-8b52-5d16da3878d2",
            "value": "172.93.181.221"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8b6b525b-15aa-44d7-a28d-b79bcaac81d1",
            "value": "155.138.159.45"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--016f8311-c677-46c9-9aa2-8f68f6e329d2",
            "created": "2026-10-09T11:16:52.838446Z",
            "modified": "2026-10-09T11:16:52.838446Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Bluenoroff_downloader_win_curl_agent: TESTING { meta: id = \"ddeb2d8f-1b10-4a33-b768-d19412e8551a\" version = \"1.0\" intrusion_set = \"Bluenoroff\" description = \"Detect the downloader used by Bluenoroff to install it CurlAgent\" source = \"SEKOIA\" creation_date = \"2023-05-02\" classification = \"TLP:WHITE\" strings: $ = \"%s\\\\marcoor.dll\" wide $ = \"curl -A cur1-agent -L %s -s -d dl\" $ = \"curl -A cur1-agent -L %s -s -d da\" $ = \"cmd /c timeout /t 10 & rundll32 \\\"%s\\\" #1\" wide $ = \"cmd /c timeout /t 10 & Del /f /q \\\"%s\\\" & attrib -s -h \\\"%s\\\" & rundll32 \\\"%s\\\" #1\" wide condition: 3 of them }",
            "pattern_type": "yara",
            "valid_from": "2023-05-22T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--19374119-49ce-46e7-b482-c30c69dd5d28",
            "created": "2026-10-09T11:16:52.838633Z",
            "modified": "2026-10-09T11:16:52.838633Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Bluenoroff_downloader_mac_RustBucket { meta: id =\"5a003b68-ad9a-47f9-b157-dd898181dac2\" version = \"1.0\" malware = \"RustBucket\" description = \"RustBucket fake PDF reader\" source = \"SEKOIA\" creation_date = \"2023-04-24\" classification = \"TLP:WHITE\" reference = \"https://tinyurl.com/5n7f56a8\" hash = \"606bce13161693844b9eb36c96554883\" hash = \"b93d7b7b30207249c1c683df16bad107\" hash = \"ca86579220eecfaede268d1520d07fae\" hash = \"f8800dd176487601ccf2e27c094b297b\" strings: $down_exec1 = \"_down_update_run\" nocase $down_exec2 = \"downAndExec\" nocase $encrypt1 = \"_encrypt_pdf\" $encrypt2 = \"_encrypt_data\" $error_msg1 = \"_alertErr\" $error_msg2 = \"_show_error_msg\" $view_pdf1 = \"-[PEPWindow view_pdf:]\" $view_pdf2 = \"-[PEPWindow viewPDF:]\" condition: (uint32be(0) == 0xcafebabe or uint32be(0) == 0xcffaedfe) and 5 of them and filesize > 50KB }",
            "pattern_type": "yara",
            "valid_from": "2023-05-22T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0b55aa3b-c4b9-4333-8401-3fc1d06cd27a",
            "hashes": {
                "MD5": "3aa30a62b01175a4fad116ce697047d3",
                "SHA-1": "789104870edcb68a8538658be345e154d32394fd",
                "SHA-256": "62a5c6a600051bca4f7b3d11508ca1f968006b71089c71bf87b83ea8b34188e3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--933094be-ae40-4564-9bbb-d3f86a12867a",
            "hashes": {
                "MD5": "6e708853bcc4a62d88a396649cba4414",
                "SHA-1": "cc4bc9336d4ddde6c7e042e176ba23cb8f022cca",
                "SHA-256": "5ca7c871dfe24b27b5cf7e9bf087f44c7620d78a1d4fa76373f22abedbdf8f82"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5cc00534-a6f7-4eee-97cf-e442ec99560d",
            "hashes": {
                "MD5": "aa548fae771e0f541463e7f6972c2a97",
                "SHA-1": "7d319c1d32d2179dfe440c522c7a39f2ddffd6af",
                "SHA-256": "f603713bffb9e040bedfd0bb675ff5a6b3205d8bd4e1a3309ea6d1b608871184"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3538d096-043d-435d-bfd8-1e7a2504fcad",
            "hashes": {
                "MD5": "699569ca855cb9b92a267b5a2319bd30",
                "SHA-1": "c779406be1becd03f494a184a98c690ee3363db1",
                "SHA-256": "5072b28399c874f92e71793fa13207d946a28a2f5903365ac11ddf666d15d086"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--eef30453-33fc-4593-aa25-452d0653fab8",
            "hashes": {
                "MD5": "539040c09434d1c31f56767b10ff5751",
                "SHA-1": "897b856f43d70b8857b527dde7b77fe2a0e76356",
                "SHA-256": "31cec2803bfc7750930d5864400388732a822da96c3f79c98ddee03949aa6a2d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f61def71-346e-40ec-a1c1-abfbae34b524",
            "hashes": {
                "MD5": "b2980ec1f221a141151686dc2475ccc0",
                "SHA-1": "21876f7632b9ddc903ea436ba2ad17211acacd75",
                "SHA-256": "3ed9f34fedca38130776e5adabae363ac797fe89087e04e0c93d83fd62a7a9a4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8b6fd48e-10e9-44ab-88a1-6981cae6203b",
            "hashes": {
                "MD5": "3ddea7cee3123f252f8cbb0c130acbb7",
                "SHA-1": "0e3064e69723ddafd377bd49b74cbe68a5633064",
                "SHA-256": "ba5e982596fd03bea98f5de96c1258e56327358e134ceecd1d68e54480533d92"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--358aac04-30fc-4ec5-adbd-403d3cdb76f5",
            "hashes": {
                "MD5": "dfda6a9b46081ef56cfd2451055700e3",
                "SHA-1": "548b24cff87fbf0de9876e02c884c41917460d9c",
                "SHA-256": "b3cb7d0b656e8e4852def8548d2cf1edc4e64116434e1f2d9c9b150ee0f9861e"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8e023fe3-f85e-44c5-ba93-150ddcd03552",
            "value": "sarahbeery.docsend.me"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f6b84cdd-e7a1-4039-8580-89a01de74eda",
            "value": "172.86.121.143"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9d6fdea2-f29a-4f23-a439-52446c03e49a",
            "value": "104.255.172.52"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--57055719-bbec-4283-8370-7f28f917dbd5",
            "value": "149.248.52.31"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--6842a816-6df8-4776-be37-a727ee50927b",
            "value": "104.234.147.28"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--07f8df80-306b-45a1-aa5e-0ca94ee4d781",
            "value": "104.156.149.130"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--212ddfa6-c0e0-43bc-81ec-5ea552e1342b",
            "value": "104.168.138.7"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--294113d8-e792-4669-96d5-f298aafbc7fe",
            "hashes": {
                "MD5": "529c65521e8a07c8810b6d225f7e2a89",
                "SHA-1": "d03ee28dc71232ba9895dd5f017ecfbd18a621ce",
                "SHA-256": "ba186a1a97d4f647dad39cb3ccae5466bb8d5463ceedf470428484416265ef5f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4a137096-5f03-4103-939d-e6d844ef8d63",
            "hashes": {
                "MD5": "5c483473641807082e530744023044fd",
                "SHA-1": "d51702b092693ff52fdb9f004b511e7935933b4d",
                "SHA-256": "8a7ba38d597e8230609df4153039d1bb898479d486e653a6d92d206dd4848c80"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4ee20afc-d7da-45c8-a78d-8e9cd275b5c0",
            "hashes": {
                "MD5": "4e05597d308d2368625dc19e86a9ca22",
                "SHA-1": "6570296a39738adb7a8d79652b45f443ab21fc45",
                "SHA-256": "5ad84c75b4a8825a4ee49fcb2ab895f0a51c9877fc4e50595fa1917ae1daa748"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--89c45080-f231-4f07-b3a2-0b8c66ef8fde",
            "value": "172.86.122.181"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c64d87fd-2d90-4c88-a5d2-cc9baeee9ced",
            "value": "104.168.174.80"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4f11149a-74c5-4261-b4ef-ea25fb424855",
            "value": "149.28.247.34"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--839dc94a-b7a2-4fb4-9f45-3094e9b4db5c",
            "value": "152.89.247.87"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0d735ff4-6a8d-438e-a8bd-3418734e4e0e",
            "value": "172.86.121.130"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--01cddeda-e2f3-49d4-a64a-6548648ce240",
            "value": "155.138.219.140"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb",
            "created": "2026-10-09T11:16:52.849314Z",
            "modified": "2026-10-09T11:16:52.849314Z",
            "name": "Bluenoroff"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--a945d1a8-ada6-48d1-b769-4f9f43edae2c",
            "created_by_ref": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2026-10-09T11:16:52.850517Z",
            "modified": "2026-10-09T11:16:52.850517Z",
            "name": "Bluenoroff\u2019s RustBucket campaign",
            "published": "2023-05-22T00:00:00Z",
            "object_refs": [
                "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
                "ipv4-addr--d481450f-a36d-4713-a050-37aaeed7fe5b",
                "file--773c479e-a07d-48fb-8e69-8b77d5e1c37e",
                "file--847c0496-d4d7-4e6c-8a0a-8f031c37332e",
                "file--3464221c-21aa-4230-85cd-338c70c6bdb3",
                "file--a6281ae2-3320-4630-a951-87f787db85e1",
                "file--0665a39a-1473-48cd-a3f1-1b0245a085b8",
                "file--808a55bb-eb2e-45bc-8278-0286ec19be35",
                "file--73f460b8-47ec-47d4-9997-92a5216feb12",
                "file--757eb651-5545-4811-abc6-ccd5b9757532",
                "file--db2b7dd0-0c96-4e14-a48d-f2f0b373c971",
                "file--f54c9af8-d63e-4e68-a868-28e5b23cba86",
                "file--d05478da-13f2-4132-9117-3b03ec09f682",
                "file--e92a0147-fc87-423f-80b2-90d707212bc7",
                "file--d4b5dff9-3d00-4468-b146-9b869ad9ddfd",
                "file--7b0ad354-1a8b-4153-b645-f815388aa001",
                "file--46e9b213-5f43-49b4-857a-3dc300a1e692",
                "file--19096ff6-36bb-40ae-9340-2fcf960c060c",
                "file--b261a9ff-a3d6-42b1-b602-2c91d483e266",
                "file--cd739a7f-c13e-4697-b335-4e47c2832ff9",
                "file--9b06bd00-96cc-44ec-9cf7-d5ee245706f3",
                "file--3c2feb23-96ba-445e-b54a-f9f5cf0e98e9",
                "file--767056cd-cf09-4fce-9d75-0372f8f18873",
                "file--9f51f5f7-19fd-4e19-ab01-8524e9126e5b",
                "file--fd609ebc-2602-4f27-9647-6d05c19d39cd",
                "file--f2036c53-1a66-4d35-885a-f3ac3ed20369",
                "file--aaa4bcf5-4eb0-4e22-81a1-47497af4f04b",
                "file--2ed870ce-c645-4968-8185-ae78ee7a84de",
                "file--740d9476-8885-4074-b353-6c241f9c80ae",
                "file--2508205f-86e1-40d7-aca2-ede13dc9c70f",
                "file--4831b205-3bf0-4249-a3c7-77939e77f035",
                "ipv4-addr--eba1efb6-356e-4389-8bfd-14352610d9cb",
                "ipv4-addr--ac082f62-1f8b-4a2e-8b52-5d16da3878d2",
                "ipv4-addr--8b6b525b-15aa-44d7-a28d-b79bcaac81d1",
                "indicator--016f8311-c677-46c9-9aa2-8f68f6e329d2",
                "indicator--19374119-49ce-46e7-b482-c30c69dd5d28",
                "file--0b55aa3b-c4b9-4333-8401-3fc1d06cd27a",
                "file--933094be-ae40-4564-9bbb-d3f86a12867a",
                "file--5cc00534-a6f7-4eee-97cf-e442ec99560d",
                "file--3538d096-043d-435d-bfd8-1e7a2504fcad",
                "file--eef30453-33fc-4593-aa25-452d0653fab8",
                "file--f61def71-346e-40ec-a1c1-abfbae34b524",
                "file--8b6fd48e-10e9-44ab-88a1-6981cae6203b",
                "file--358aac04-30fc-4ec5-adbd-403d3cdb76f5",
                "domain-name--8e023fe3-f85e-44c5-ba93-150ddcd03552",
                "ipv4-addr--f6b84cdd-e7a1-4039-8580-89a01de74eda",
                "ipv4-addr--9d6fdea2-f29a-4f23-a439-52446c03e49a",
                "ipv4-addr--57055719-bbec-4283-8370-7f28f917dbd5",
                "ipv4-addr--6842a816-6df8-4776-be37-a727ee50927b",
                "ipv4-addr--07f8df80-306b-45a1-aa5e-0ca94ee4d781",
                "ipv4-addr--212ddfa6-c0e0-43bc-81ec-5ea552e1342b",
                "file--294113d8-e792-4669-96d5-f298aafbc7fe",
                "file--4a137096-5f03-4103-939d-e6d844ef8d63",
                "file--4ee20afc-d7da-45c8-a78d-8e9cd275b5c0",
                "ipv4-addr--89c45080-f231-4f07-b3a2-0b8c66ef8fde",
                "ipv4-addr--c64d87fd-2d90-4c88-a5d2-cc9baeee9ced",
                "ipv4-addr--4f11149a-74c5-4261-b4ef-ea25fb424855",
                "ipv4-addr--839dc94a-b7a2-4fb4-9f45-3094e9b4db5c",
                "ipv4-addr--0d735ff4-6a8d-438e-a8bd-3418734e4e0e",
                "ipv4-addr--01cddeda-e2f3-49d4-a64a-6548648ce240",
                "threat-actor--f7f0d913-f17b-5632-a48a-76b4eef8a1cb"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.sekoia.io/bluenoroffs-rustbucket-campaign/"
                }
            ]
        }
    ]
}