{
    "type": "bundle",
    "id": "bundle--0a810829-b6ac-4fb6-99a1-43ad212b9291",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
            "created": "2023-03-08T12:51:48.041368Z",
            "modified": "2025-01-30T02:20:08.905936Z",
            "name": "Google",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9915c9bf-525f-4f00-a266-524e57912f79",
            "value": "sfrclak.com"
        },
        {
            "type": "email-addr",
            "spec_version": "2.1",
            "id": "email-addr--80e7e8d8-7edf-47e2-af5e-d83f1479276b",
            "value": "ifstap@proton.me"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--794180bf-52c3-45df-bf94-6810144b7a2f",
            "value": "142.11.206.73"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--31724907-c57a-4919-88b7-9fb153f4aff3",
            "hashes": {
                "MD5": "089e2872016f75a5223b5e02c184dfec",
                "SHA-1": "978407431d75885228e0776913543992a9eb7cc4",
                "SHA-256": "f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e1c69ddd-9282-4fea-8b19-56289e7e718e",
            "hashes": {
                "MD5": "7658962ae060a222c0058cd4e979bfa1",
                "SHA-1": "b0e0f12f1be57dc67fa375e860cedd19553c464d",
                "SHA-256": "e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--113f928b-46fb-459a-85b4-12ac83442552",
            "hashes": {
                "MD5": "04e3073b3cd5c5bfcde6f575ecf6e8c1",
                "SHA-1": "a90c26e7cbb3440ac1cad75cf351cbedef7744a8",
                "SHA-256": "617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--15d803c1-f248-4623-af7b-f379f2a36962",
            "value": "http://sfrclak.com:8000/6202033"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b3b95bf6-20c0-4805-b3fa-c3220a2c640c",
            "created": "2026-09-19T08:44:12.685496Z",
            "modified": "2026-09-19T08:44:12.685496Z",
            "name": "YARA Rule",
            "pattern": "rule G_Hunting_Downloader_SILKBELL_1\r\n{\r\nmeta:\r\ndescription = \"Detects the obfuscated version of the JS NPM supply chain downloader using Base64 obfuscation and custom XOR. Associated with WAVESHAPER.V2\"\r\nauthor = \"GTIG\"\r\nmd5 = \"7658962ae060a222c0058cd4e979bfa1\"\r\ndate_created = \"2026/03/31\"\r\ndate_modified = \"2026/03/31\"\r\nrev = 1\r\nplatforms = \"Any\"\r\nstrings:\r\n$ss1 = \"OrDeR_7077\" ascii wide fullword\r\n$ss2 = \"String.fromCharCode(S^a^333)\" ascii wide\r\n$ss3 = \"\\\"TE9DQUw^\\\".replaceAll(\\\"^\\\",\\\"=\\\")\" ascii wide\r\n$ss4 = \"\\\"UFM_\\\".replaceAll(\\\"_\\\",\\\"=\\\")\" ascii wide\r\n$ss5 = \"\\\"U0NSXw--\\\".replaceAll(\\\"-\\\",\\\"=\\\")\" ascii wide\r\n$ss6 = \"\\\"UFNfQg--\\\".replaceAll(\\\"-\\\",\\\"=\\\")\" ascii wide\r\n$ss7 = \"\\\"d2hlcmUgcG93ZXJzaGVsbA((\\\".replaceAll(\\\"(\\\",\\\"=\\\")\" ascii wide\r\ncondition:\r\nuint16(0) != 0x5A4D and filesize < 100KB and all of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d647cfb7-3e49-49b1-b6b8-e306ee614eda",
            "created": "2026-09-19T08:44:12.686294Z",
            "modified": "2026-09-19T08:44:12.686294Z",
            "name": "YARA Rule",
            "pattern": "rule G_Hunting_Downloader_suspected_UNC1069_PS_1\r\n{\r\nmeta:\r\ndescription = \"Detects PowerShell dropper associated with suspected UNC1069 and Axios npm package supply chain attack. Associated to WAVESHAPER.V2\"\r\nauthor = \"GTIG\"\r\nmd5 = \"089e2872016f75a5223b5e02c184dfec\"\r\ndate_created = \"2026/03/31\"\r\ndate_modified = \"2026/03/31\"\r\nrev = 1\r\nplatforms = \"Windows\"\r\nstrings:\r\n$ss1 = \"start /min powershell -w h\" ascii wide nocase\r\n$ss2 = \"[scriptblock]::Create([System.Text.Encoding]::UTF8.GetString\" ascii wide nocase\r\n$ss3 = \"Invoke-WebRequest -UseBasicParsing\" ascii wide nocase\r\n$ss4 = \"-Method POST -Body\" ascii wide nocase\r\n$ss5 = \"packages.npm.org/product1\" ascii wide nocase\r\ncondition:\r\nuint16(0) != 0x5A4D and filesize < 5KB and all of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2026-04-01T00:00:00Z"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--b1fc54ae-4fb3-5833-9e0f-4873d16620f8",
            "created": "2026-09-19T08:44:12.687578Z",
            "modified": "2026-09-19T08:44:12.687578Z",
            "name": "UNC1069"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--313452b6-1e9f-43e8-af27-c1c332ab842a",
            "created_by_ref": "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
            "created": "2026-09-19T08:44:12.688814Z",
            "modified": "2026-09-19T08:44:12.688814Z",
            "name": "North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack",
            "published": "2026-04-01T00:00:00Z",
            "object_refs": [
                "identity--703b0d0d-f70a-4de2-bff5-d252e8d966f9",
                "domain-name--9915c9bf-525f-4f00-a266-524e57912f79",
                "email-addr--80e7e8d8-7edf-47e2-af5e-d83f1479276b",
                "ipv4-addr--794180bf-52c3-45df-bf94-6810144b7a2f",
                "file--31724907-c57a-4919-88b7-9fb153f4aff3",
                "file--e1c69ddd-9282-4fea-8b19-56289e7e718e",
                "file--113f928b-46fb-459a-85b4-12ac83442552",
                "url--15d803c1-f248-4623-af7b-f379f2a36962",
                "indicator--b3b95bf6-20c0-4805-b3fa-c3220a2c640c",
                "indicator--d647cfb7-3e49-49b1-b6b8-e306ee614eda",
                "threat-actor--b1fc54ae-4fb3-5833-9e0f-4873d16620f8"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package"
                }
            ]
        }
    ]
}