{
    "type": "bundle",
    "id": "bundle--4da7d21c-37d8-4e06-b6e5-c100803abef9",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--483c1127-0f26-473b-8bf2-e2f7ab2c0c1f",
            "created": "2023-03-08T12:52:00.332108Z",
            "modified": "2025-02-23T23:00:11.709116Z",
            "name": "Checkpoint",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--cf664712-146c-4152-95e5-a91ef241dcca",
            "created": "2026-08-12T01:47:43.265255Z",
            "modified": "2026-08-12T01:47:43.265255Z",
            "name": "YARA Rule",
            "pattern": "rule lazarus_relayshell\n{\nmeta:\nauthor = \"@_CPResearch_\"\ndescription = \"Lazarus RelayShell Webshell\"\ntarget_entity = \"file\"\nhash = \"21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762\"\nstrings:\n$str1 = \"'PqCWom'\"\n$str2 = \"'a84038'\"\n$str3 = \"'biwbih'\"\n$str4 = \"'ddf7acea'\"\n$str5 = \"'enRU904U'\"\n$str6 = \"'fou2rm'\"\n$str7 = \"'kurhiW'\"\n$str8 = \"'qcrgl'\"\n$str9 = \"'rlzbiw'\"\n$str10 = \"'tmmvr1'\"\n$str11 = \"'win386'\"\n$str12 = \"\\\"biwbih\\\"\"\n$str13 = \"\\\"PqCWom\\\"\"\n$str14 = \"\\\"a84038\\\"\"\n$str15 = \"\\\"ddf7acea\\\"\"\n$str16 = \"\\\"enRU904U\\\"\"\n$str17 = \"\\\"fou2rm\\\"\"\n$str18 = \"\\\"kurhiW\\\"\"\n$str19 = \"\\\"qcrgl\\\"\"\n$str20 = \"\\\"rlzbiw\\\"\"\n$str21 = \"\\\"tmmvr1\\\"\"\n$str22 = \"\\\"win386\\\"\"\n$str23 = \"D9hWnVEqdgzJ67/B8euS0yKCIMrw5jc:fGUX3AakLH2oYQRp\"\ncondition:\n3 of ($str*)\n}",
            "pattern_type": "yara",
            "valid_from": "2026-08-11T00:00:00Z"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0ea23731-884f-4421-b4cc-e1c86a1aad1d",
            "value": "135.181.185.158"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2a6e4a3e-9db8-407b-8e8d-45784d1b0e2a",
            "value": "uxtramine.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--14ba62c0-71aa-4926-b71f-d1c8d4136c30",
            "value": "enveil.online"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--466d5bf7-caf7-4981-b5ca-751f2ebbb5c8",
            "value": "135.181.67.203"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2602fb67-8a07-4343-aa5b-89b17afdb07b",
            "value": "envell.xyz"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2bdc83c4-32ce-4224-811b-38850e3e7d69",
            "hashes": {
                "SHA-256": "cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--51599ef8-4bdd-4215-9ac6-1bb9fe984e35",
            "hashes": {
                "SHA-256": "21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0f2c9720-0ee2-4310-b24c-6bdc663f1fe5",
            "hashes": {
                "SHA-256": "a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--646dbf75-2427-4a8a-b1fb-dd21a498e8c7",
            "hashes": {
                "SHA-256": "68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ebcfef3a-b2bc-48fc-b2d5-2c701dc8426d",
            "hashes": {
                "SHA-256": "590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f52d6d6e-afac-473a-8b9a-1a797613a03d",
            "hashes": {
                "SHA-256": "db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c1a93eb3-e0e8-4c9b-b587-558fa4a7a4ce",
            "hashes": {
                "SHA-256": "743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--24c8a214-c463-4b7b-a6b4-5b43d975e392",
            "hashes": {
                "SHA-256": "d578c28c9afe7457a0d81f6701332ef8197e8f7468de654935fb29a50ea66459"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--63747b1b-dd17-4c2e-a314-0d2fcdea8fa4",
            "hashes": {
                "SHA-256": "fecf12088843801215898442bd1ff3e266f29d14e29a94780e857f69c4915d6b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d208a38d-e964-47ad-896f-aed7c5cd92b3",
            "hashes": {
                "SHA-256": "3601060c62edeeaa49def6a13be6e126e1024ce011faad4e2d9f585ccf6bd5a6"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b375d8fc-ef83-4ce6-97de-df9181415c22",
            "hashes": {
                "SHA-256": "acb97cec84e08b89f41967a24e965d1fd2c51751cef158f7aa35bb4306b87b97"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b6c5e318-5620-46d6-a1fd-2f6355cf7b43",
            "hashes": {
                "SHA-256": "8ce6c29f92dc45b1474417cbdff4ed0c18e58fa63e3a071ee9f85aa9d2aac07c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9037e425-7359-4f88-a2f1-1b2cb8c61969",
            "hashes": {
                "SHA-256": "a673ae661593c0de9bbb815593b816a6853dad6d55ad5042d2ef1875cd13d6e7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--54fa4112-9a96-40d3-9266-1dd4cbd856f4",
            "hashes": {
                "SHA-256": "3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f79296c9-347d-4913-b27d-e5c26fc30c30",
            "hashes": {
                "SHA-256": "82268052f94df6f4870d02e57b18d4c54136cc7a8c8d80ad162631f99462c943"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--559a42aa-52df-455b-b0bc-0eb109d5303a",
            "hashes": {
                "SHA-256": "a0578a2b7821d7e2c573530648f26d7a0d98b373ab24fb7f0c792736761e542d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2edf5c14-72b8-4ca1-835a-e5e70ade45a7",
            "hashes": {
                "SHA-256": "6da9b1e6f3315ceb77dd14a937a26cc3602bf6a7e2c2ecafb3c65ce5319837be"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7bdebaa8-a7ff-4123-b11e-1244e8812dd1",
            "hashes": {
                "SHA-256": "231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d858"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e1082dbb-5d76-45fc-83da-2576f0bbbb89",
            "hashes": {
                "SHA-256": "72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1d2a89d6-4951-4a8c-b294-65a6b5f5945d",
            "hashes": {
                "SHA-256": "ba96c603e44046de703c67b2c3b7e4ca974afef7b437a0244418bc4edc781bb7"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--348768dc-e04a-4d93-bca4-63eb5cb81516",
            "hashes": {
                "SHA-256": "4dd792c9f672bbdcc8d363d745994efe90f4ffc5fdc2c059c8e379a48ad6a68a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9f05bab0-e0b2-436a-afc5-22c84a87196e",
            "hashes": {
                "SHA-256": "4fd32432341dfcf54d0517a6bbc38e5d265be70933493e4183c2a340cdde9a2d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--336fe8d9-93a5-4825-97ba-4fba553e48c9",
            "hashes": {
                "SHA-256": "13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef79"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b3e73e6c-4228-4144-a8d7-80ebfbf6134a",
            "hashes": {
                "SHA-256": "ea7056f2bf36c66a61ff787ff5be975a85f534c3c5ca178791dac2504db2c619"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9083ccdd-6db9-4f31-87d3-c99122e8c512",
            "hashes": {
                "SHA-256": "fb3fc5626f68677fb1269a2fefbe70e719211b4065e836ab92e06a8210139a2d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bce50d84-fad9-47e1-8f28-acf982697ae1",
            "hashes": {
                "SHA-256": "b4082d21070d9ddf53fde4ea22524d09e41ec9826ce63cef3c6235e458d21afb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--73a7b58c-6174-41dd-ae24-ce7898135974",
            "hashes": {
                "SHA-256": "5278ee922838352f1480a73e971161017d643a80b7ec22bf725897dfd088696d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--b29f8668-ef8a-41cd-bd9e-60e8f35db4c7",
            "hashes": {
                "SHA-256": "2db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e0874ff0-ef83-4262-9985-472744d19deb",
            "hashes": {
                "SHA-256": "c2aa28bb5e2a749c693712008276f311edd912f689371ef9e8a1ee5fb4167461"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--4e086b0f-9cef-40e6-8a50-d457dd7fa815",
            "hashes": {
                "SHA-256": "4ebdce2f47c23ff8c9e8e80c8b5239c7a5764da31cd3ab8f0505926890adc105"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--84217dc7-f615-456b-8256-9ef1ea22ba4a",
            "hashes": {
                "SHA-256": "29e24c007549e51319ff3aee011da6f9f93568e8c85a5ad69c9e53bd3f4533a2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8af11a2e-ee85-4e6b-a94b-7d11c361d9e2",
            "hashes": {
                "SHA-256": "4c9b804d6155b29f1e27a9ffe531e10bc42a7bdab42f905b50146bf2026768d9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--63b4ec7a-adf8-4e26-b2e4-f7c990af9a98",
            "hashes": {
                "SHA-256": "1de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d47cff6e-b3b9-48a4-ac1a-5c9c94b0a764",
            "hashes": {
                "SHA-256": "a45144d22cac70a45d71cf4dffa4efbc373658779a56cf1300d6ac863d6cc7e2"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--468d7483-60da-408e-bc0e-0f7f6191885e",
            "hashes": {
                "SHA-256": "75b93a7103b0562f6497d30052c0c5cf7aa58c1bf0e9297022b74469a7f096f1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3f7f5cb9-c713-4644-a499-332b1ed4a109",
            "hashes": {
                "SHA-256": "f7e620134ca935067797ab957317b346ce0df84a4e9b9ca54a6acc9b75afda4d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c6badd22-3603-4012-85e9-a3f7ca3062bb",
            "hashes": {
                "SHA-256": "396192d92d17ace1a521f1351eeeba2825e60badd0d799cc5c338e4934b3c82c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dca1690f-ca52-42c5-979e-ea2593d4df8b",
            "hashes": {
                "SHA-256": "92106b0c62a0a42678232f8273f030b2d3c8e92efce81b98b9eec70cfe98afa1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f95f0c3d-9c66-4cb0-8056-2e60b3645d8f",
            "hashes": {
                "SHA-256": "3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--da73fe45-0274-4ae2-9c0f-c642e2ecd13d",
            "hashes": {
                "SHA-256": "2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-08-12T01:47:43.272752Z",
            "modified": "2026-08-12T01:47:43.272752Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--1664ccff-399a-41f3-9ab6-eed9a2bf5036",
            "created_by_ref": "identity--483c1127-0f26-473b-8bf2-e2f7ab2c0c1f",
            "created": "2026-08-12T01:47:43.27426Z",
            "modified": "2026-08-12T01:47:43.27426Z",
            "name": "Shattering the Dream \u2013 When a Job Offer Becomes a Zero-Day Attack",
            "published": "2026-08-11T00:00:00Z",
            "object_refs": [
                "identity--483c1127-0f26-473b-8bf2-e2f7ab2c0c1f",
                "indicator--cf664712-146c-4152-95e5-a91ef241dcca",
                "ipv4-addr--0ea23731-884f-4421-b4cc-e1c86a1aad1d",
                "domain-name--2a6e4a3e-9db8-407b-8e8d-45784d1b0e2a",
                "domain-name--14ba62c0-71aa-4926-b71f-d1c8d4136c30",
                "ipv4-addr--466d5bf7-caf7-4981-b5ca-751f2ebbb5c8",
                "domain-name--2602fb67-8a07-4343-aa5b-89b17afdb07b",
                "file--2bdc83c4-32ce-4224-811b-38850e3e7d69",
                "file--51599ef8-4bdd-4215-9ac6-1bb9fe984e35",
                "file--0f2c9720-0ee2-4310-b24c-6bdc663f1fe5",
                "file--646dbf75-2427-4a8a-b1fb-dd21a498e8c7",
                "file--ebcfef3a-b2bc-48fc-b2d5-2c701dc8426d",
                "file--f52d6d6e-afac-473a-8b9a-1a797613a03d",
                "file--c1a93eb3-e0e8-4c9b-b587-558fa4a7a4ce",
                "file--24c8a214-c463-4b7b-a6b4-5b43d975e392",
                "file--63747b1b-dd17-4c2e-a314-0d2fcdea8fa4",
                "file--d208a38d-e964-47ad-896f-aed7c5cd92b3",
                "file--b375d8fc-ef83-4ce6-97de-df9181415c22",
                "file--b6c5e318-5620-46d6-a1fd-2f6355cf7b43",
                "file--9037e425-7359-4f88-a2f1-1b2cb8c61969",
                "file--54fa4112-9a96-40d3-9266-1dd4cbd856f4",
                "file--f79296c9-347d-4913-b27d-e5c26fc30c30",
                "file--559a42aa-52df-455b-b0bc-0eb109d5303a",
                "file--2edf5c14-72b8-4ca1-835a-e5e70ade45a7",
                "file--7bdebaa8-a7ff-4123-b11e-1244e8812dd1",
                "file--e1082dbb-5d76-45fc-83da-2576f0bbbb89",
                "file--1d2a89d6-4951-4a8c-b294-65a6b5f5945d",
                "file--348768dc-e04a-4d93-bca4-63eb5cb81516",
                "file--9f05bab0-e0b2-436a-afc5-22c84a87196e",
                "file--336fe8d9-93a5-4825-97ba-4fba553e48c9",
                "file--b3e73e6c-4228-4144-a8d7-80ebfbf6134a",
                "file--9083ccdd-6db9-4f31-87d3-c99122e8c512",
                "file--bce50d84-fad9-47e1-8f28-acf982697ae1",
                "file--73a7b58c-6174-41dd-ae24-ce7898135974",
                "file--b29f8668-ef8a-41cd-bd9e-60e8f35db4c7",
                "file--e0874ff0-ef83-4262-9985-472744d19deb",
                "file--4e086b0f-9cef-40e6-8a50-d457dd7fa815",
                "file--84217dc7-f615-456b-8256-9ef1ea22ba4a",
                "file--8af11a2e-ee85-4e6b-a94b-7d11c361d9e2",
                "file--63b4ec7a-adf8-4e26-b2e4-f7c990af9a98",
                "file--d47cff6e-b3b9-48a4-ac1a-5c9c94b0a764",
                "file--468d7483-60da-408e-bc0e-0f7f6191885e",
                "file--3f7f5cb9-c713-4644-a499-332b1ed4a109",
                "file--c6badd22-3603-4012-85e9-a3f7ca3062bb",
                "file--dca1690f-ca52-42c5-979e-ea2593d4df8b",
                "file--f95f0c3d-9c66-4cb0-8056-2e60b3645d8f",
                "file--da73fe45-0274-4ae2-9c0f-c642e2ecd13d",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"
                }
            ]
        }
    ]
}