{
    "type": "bundle",
    "id": "bundle--7fe3d918-0542-42fd-bb5e-2d39b8d3a21d",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
            "created": "2023-03-08T12:51:55.504513Z",
            "modified": "2024-09-12T13:07:45.993173Z",
            "name": "Cyfirma",
            "identity_class": "organization"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--897cfb0e-297c-4b29-9863-b59239288880",
            "created": "2026-10-24T02:57:50.916866Z",
            "modified": "2026-10-24T02:57:50.916866Z",
            "name": "YARA Rule",
            "pattern": "import \"hash\"\n\nrule PHP2Shell_SecondStage_ELF_SHA256\n{\n    meta:\n        description = \"Detects the PHP2Shell second-stage ELF x86-64 binary delivered by the observed loader\"\n        author = \"CYFIRMA Research\"\n        date = \"2026-10-22\"\n        category = \"Threat Intelligence\"\n        severity = \"High\"\n        hash = \"0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486\"\n        source_note = \"Single honeypot vendor, 21 Oct 2026; not independently corroborated\"\n        scan_scope = \"/tmp, /var/tmp, /dev/shm, web roots. The loader writes to /tmp and executes; the file may be deleted after launch\"\n    condition:\n        uint32(0) == 0x464C457F and\n        filesize == 179632 and\n        hash.sha256(0, filesize) == \"0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486\"\n}",
            "pattern_type": "yara",
            "valid_from": "2026-10-23T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--85d9c40d-883c-4541-aad6-c7465be9a102",
            "hashes": {
                "MD5": "b61a098fc62a2c2696e196dca78da71a",
                "SHA-1": "c472dab4ff7c16782a8037f988d4daa6d4bdb343",
                "SHA-256": "0c5486f06620e26e316f4b33f318b0d646d5e1133789331aa2fed012360d1486"
            }
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0147fbc9-225e-476b-9c62-d9207372ac4c",
            "value": "109.71.252.97"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--1e13e0ab-934c-4f4e-9d1b-acbce8a9cd48",
            "value": "45.198.224.169"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--40d0a37b-c90b-4b2f-9cb3-c9318d3d3bde",
            "value": "85.11.167.243"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--abda0f01-d761-4eda-a7c3-abcd6421c24c",
            "value": "95.217.98.37"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--56e0a395-e7cb-4dd1-a24a-d7a5420ee762",
            "value": "103.114.163.188"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--18ac2cbd-5e83-460b-9a27-b356096592d2",
            "value": "134.209.159.64"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0bc0bbeb-c763-4295-85bc-edb123996201",
            "value": "37.19.200.5"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--885d9c99-fb24-4369-a1f3-d237561dada7",
            "value": "31.223.184.166"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--fe966287-f05d-4b06-8a30-1b315911a415",
            "value": "103.216.220.92"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--185ccaed-79cc-456b-a30b-307f890e0328",
            "value": "http://92.118.112.100/nfs"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ad649f89-0ab4-4ad0-a9bf-e6a23909a96a",
            "value": "92.118.112.100"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--47888ccc-5bdf-47c2-8107-01ecc260146c",
            "value": "134.209.181.133"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f95d1225-3295-42ea-ade0-1e22c4feac84",
            "value": "78.47.85.99"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--20daafdb-315c-43b2-a426-03fcf8372284",
            "value": "188.80.228.122"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c9456f7c-2281-43fe-be92-079923cd50ec",
            "value": "185.207.232.121"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--50e3a821-ad47-4910-bed0-727f1aac9c90",
            "value": "124.122.142.142"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5e1dbe2c-72b5-420f-863b-24b821bfdb1b",
            "value": "115.96.27.126"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7a72ed52-6b86-4a36-bdc5-e4b5457be22d",
            "value": "95.217.164.124"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--5b9dbeb6-8702-4d31-b28f-f61a7e4446d7",
            "value": "103.21.161.105"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b2bcd98a-a9f0-4991-a92d-7149e0ae0dd1",
            "value": "146.190.107.103"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--dabf89bf-6e4e-429f-b08a-37f47d53d543",
            "value": "95.216.5.90"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4a881787-703c-4526-a4e1-c4062d9be870",
            "value": "117.203.73.63"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ee610f8b-038c-4c09-8943-b9808864f026",
            "value": "138.68.161.170"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9f964825-2bac-4e7a-9b38-743da5315437",
            "value": "75.119.143.189"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--4d2b0a9c-16d0-4df2-9c3d-d369bf2752c6",
            "value": "119.63.72.54"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--3c2a71c9-4a7f-434a-af88-33c447dcbf8b",
            "value": "94.154.43.185"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--7721f09c-54c2-45ea-89b8-e3c82ca0fbe4",
            "value": "134.209.252.157"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--84f5c95a-02e8-4f97-a97e-b097e4468451",
            "value": "102.207.250.188"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--0f3995bb-2eb1-44ee-81dd-a4f6044a10e1",
            "value": "147.78.168.67"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--afa394d7-c3a4-4554-8098-5552f04e74af",
            "value": "158.173.242.133"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--32ce835f-befd-4dbc-b9e3-56e552df6a67",
            "value": "149.102.232.93"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2af18eb5-7369-482c-a620-8e419b20ba55",
            "value": "149.102.232.44"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9babf9b4-2466-45ee-b3c9-0d2afacb6c5d",
            "value": "145.255.150.25"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--df33b39d-1198-4c1d-b60c-1224cb4a543f",
            "value": "138.199.34.201"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--ef765d1f-294e-45e1-81d5-4b8f8a4e3c8d",
            "value": "128.90.176.13"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e904f794-118c-44b5-82b5-1d90fc7156da",
            "value": "103.77.210.80"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--2a5af663-f9e8-40d2-b8c8-3dea7867a207",
            "value": "185.235.212.105"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--adedee62-edd9-4eae-a880-e68518c823f5",
            "value": "185.203.18.54"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--44747263-b5e3-447c-8d4e-151c2a7589fb",
            "value": "158.173.75.178"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--91745b19-02d1-41cd-bfcc-63b0e2f20f81",
            "value": "109.56.219.150"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--a8c390c5-d141-4f11-a6e8-6b6576e04c11",
            "value": "147.78.168.57"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--fa9107f3-a197-4760-bfca-ae66793ce328",
            "value": "147.175.149.67"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--b5b6d60e-32a5-4c77-829f-666686df3a14",
            "value": "146.70.114.182"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--07e68973-a360-4190-ae4c-065629bf75f6",
            "value": "146.70.114.180"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-10-24T02:57:50.922997Z",
            "modified": "2026-10-24T02:57:50.922997Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--14e7ee11-2295-4512-8d61-23ed1da7f494",
            "created_by_ref": "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
            "created": "2026-10-24T02:57:50.924595Z",
            "modified": "2026-10-24T02:57:50.924595Z",
            "name": "Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure",
            "published": "2026-10-23T00:00:00Z",
            "object_refs": [
                "identity--a376a29c-d499-4d13-a9b0-c30b2b36c12d",
                "indicator--897cfb0e-297c-4b29-9863-b59239288880",
                "file--85d9c40d-883c-4541-aad6-c7465be9a102",
                "ipv4-addr--0147fbc9-225e-476b-9c62-d9207372ac4c",
                "ipv4-addr--1e13e0ab-934c-4f4e-9d1b-acbce8a9cd48",
                "ipv4-addr--40d0a37b-c90b-4b2f-9cb3-c9318d3d3bde",
                "ipv4-addr--abda0f01-d761-4eda-a7c3-abcd6421c24c",
                "ipv4-addr--56e0a395-e7cb-4dd1-a24a-d7a5420ee762",
                "ipv4-addr--18ac2cbd-5e83-460b-9a27-b356096592d2",
                "ipv4-addr--0bc0bbeb-c763-4295-85bc-edb123996201",
                "ipv4-addr--885d9c99-fb24-4369-a1f3-d237561dada7",
                "ipv4-addr--fe966287-f05d-4b06-8a30-1b315911a415",
                "url--185ccaed-79cc-456b-a30b-307f890e0328",
                "ipv4-addr--ad649f89-0ab4-4ad0-a9bf-e6a23909a96a",
                "ipv4-addr--47888ccc-5bdf-47c2-8107-01ecc260146c",
                "ipv4-addr--f95d1225-3295-42ea-ade0-1e22c4feac84",
                "ipv4-addr--20daafdb-315c-43b2-a426-03fcf8372284",
                "ipv4-addr--c9456f7c-2281-43fe-be92-079923cd50ec",
                "ipv4-addr--50e3a821-ad47-4910-bed0-727f1aac9c90",
                "ipv4-addr--5e1dbe2c-72b5-420f-863b-24b821bfdb1b",
                "ipv4-addr--7a72ed52-6b86-4a36-bdc5-e4b5457be22d",
                "ipv4-addr--5b9dbeb6-8702-4d31-b28f-f61a7e4446d7",
                "ipv4-addr--b2bcd98a-a9f0-4991-a92d-7149e0ae0dd1",
                "ipv4-addr--dabf89bf-6e4e-429f-b08a-37f47d53d543",
                "ipv4-addr--4a881787-703c-4526-a4e1-c4062d9be870",
                "ipv4-addr--ee610f8b-038c-4c09-8943-b9808864f026",
                "ipv4-addr--9f964825-2bac-4e7a-9b38-743da5315437",
                "ipv4-addr--4d2b0a9c-16d0-4df2-9c3d-d369bf2752c6",
                "ipv4-addr--3c2a71c9-4a7f-434a-af88-33c447dcbf8b",
                "ipv4-addr--7721f09c-54c2-45ea-89b8-e3c82ca0fbe4",
                "ipv4-addr--84f5c95a-02e8-4f97-a97e-b097e4468451",
                "ipv4-addr--0f3995bb-2eb1-44ee-81dd-a4f6044a10e1",
                "ipv4-addr--afa394d7-c3a4-4554-8098-5552f04e74af",
                "ipv4-addr--32ce835f-befd-4dbc-b9e3-56e552df6a67",
                "ipv4-addr--2af18eb5-7369-482c-a620-8e419b20ba55",
                "ipv4-addr--9babf9b4-2466-45ee-b3c9-0d2afacb6c5d",
                "ipv4-addr--df33b39d-1198-4c1d-b60c-1224cb4a543f",
                "ipv4-addr--ef765d1f-294e-45e1-81d5-4b8f8a4e3c8d",
                "ipv4-addr--e904f794-118c-44b5-82b5-1d90fc7156da",
                "ipv4-addr--2a5af663-f9e8-40d2-b8c8-3dea7867a207",
                "ipv4-addr--adedee62-edd9-4eae-a880-e68518c823f5",
                "ipv4-addr--44747263-b5e3-447c-8d4e-151c2a7589fb",
                "ipv4-addr--91745b19-02d1-41cd-bfcc-63b0e2f20f81",
                "ipv4-addr--a8c390c5-d141-4f11-a6e8-6b6576e04c11",
                "ipv4-addr--fa9107f3-a197-4760-bfca-ae66793ce328",
                "ipv4-addr--b5b6d60e-32a5-4c77-829f-666686df3a14",
                "ipv4-addr--07e68973-a360-4190-ae4c-065629bf75f6",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://www.cyfirma.com/research/cyfirma-threat-advisory-suspected-dprk-campaign-staging-php2shell-targeting-against-global-php-infrastructure"
                }
            ]
        }
    ]
}