{
    "type": "bundle",
    "id": "bundle--2b5ed440-0581-444c-8468-0baa57eeba1e",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2023-03-08T12:51:43.216431Z",
            "modified": "2023-03-16T12:47:56.421112Z",
            "name": "SEKOIA",
            "identity_class": "organization"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--14c9cf4a-0953-497d-ba4c-bcd1b67feae5",
            "value": "154.62.226.22"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e415e7dc-8310-497b-909e-69413c4db172",
            "value": "38.134.148.218"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8ae29832-9016-472d-8632-5263bc0a0d53",
            "value": "evalvidz.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3cfc541d-692d-4950-9196-5c9b6ab906ae",
            "value": "vidhirehub.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--305962b2-5b80-48f1-acef-d6d09a21cd1b",
            "value": "evalassesso.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--28726dbe-ca9b-485f-a3bb-933917a108a7",
            "value": "vidassesspro.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--653ad022-9010-4fd3-94a2-9fd16423992e",
            "value": "evalswift.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5d62a332-bedc-4c9d-b79c-3de038aa157f",
            "hashes": {
                "SHA-256": "ba81429101a558418c80857781099e299c351b09c8c8ad47df2494634a5332dc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--11e71e8e-f27a-4526-96b1-b7dc764e3334",
            "hashes": {
                "SHA-256": "e88700d069a856e1a16c0da317a6f18fa626dd2d46dcbee1a7403d2e2d9ed097"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--dc9eecc4-5f74-4f91-b098-c6cb6b2e52e2",
            "hashes": {
                "SHA-256": "0cbbf7b2b15b561d47e927c37f6e9339fe418badf49fa5f6fc5c49f0dc981100"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--19a77dbf-4759-4c9f-b065-ef5f21483e41",
            "hashes": {
                "SHA-256": "6e186ada6371f5b970b25c78f38511af8d10faaeaed61042271892a327099925"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bd57fd24-3b9d-408f-9d42-1ff60935be9d",
            "hashes": {
                "SHA-256": "d00ca82a32b5e8063492f27dfec225b0888cd6135db3e2af65be3782bbfa16e5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fba560d9-13b8-4a46-b16a-f569802310c8",
            "hashes": {
                "SHA-256": "887189269c3594e1a851eb22f7c174a7c28618114b7dbaab6b645f34bd809f5a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a54cfb95-d216-4fbc-aba5-25a51f6c37d4",
            "hashes": {
                "SHA-256": "6289ef57b1772d78da0e54ba4730b6fc79f5ec1620ff63c3abaebea70190eba9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6db1f49d-551e-4fa2-9c22-37b7c821812b",
            "hashes": {
                "SHA-256": "b7b9e7637a42b5db746f1876a2ecb19330403ecb4ec6f5575db4d94df8ec79e8"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--1c210c64-6941-4519-913b-b14e61d04f00",
            "hashes": {
                "SHA-256": "3fec701b5e8486081c7062590f4ff947fcf51246cb067f951e90eb43dad930b4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--003a947f-af1a-4dfd-b54a-7f7ab85930d6",
            "hashes": {
                "SHA-256": "ef9f49f14149bed09ca9f590d33e07f3a749e1971a31cb19a035da8d84f97aa0"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cb2fa405-069b-411d-b6c2-7a29dc9bc5a4",
            "hashes": {
                "SHA-256": "f4b4411e403dd5094eef9c8946522fc9a99cf1676c8de5926b3c343264b126e6"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0c054012-aa97-4339-847b-dcc21b964ea2",
            "value": "api.camdriversupport.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--40077f8b-fa68-4ded-ab70-e6d3cece5358",
            "value": "talenthiring360.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--411c9cc7-a09e-4f50-a38c-1b10e1f77415",
            "value": "vid-crypto-assess.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--105ac519-1f49-4c93-9a54-929b6fe60ab2",
            "value": "api.camtechdrivers.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0351dcb8-48fb-42c6-9a6e-0885da77c671",
            "value": "vidcruitermaster.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--c7470c39-54ba-4de7-97e9-18c1594b02c2",
            "value": "72.5.42.93"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7575ad49-7c43-42dc-9985-6b622826e021",
            "value": "quickinterview360.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7cb28808-cde3-44d6-bca9-f3d5a116cc65",
            "hashes": {
                "SHA-256": "bfac94bfb53b4c0ac346706b06296353462a26fa3bb09fbfc99e3ca090ec127e"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--41618628-fc53-4a3c-9236-a9f3e50aaea7",
            "value": "api.camera-drive.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--60c5d1d1-614f-4922-a0c6-75550c8364ec",
            "value": "api.nvidia-release.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--88fd2c55-6865-4fe5-99b8-7704080b0375",
            "value": "vidintermaster.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b3901ced-f027-482f-ae8b-ef29b1b3e59a",
            "created": "2026-06-24T19:55:31.379207Z",
            "modified": "2026-06-24T19:55:31.379207Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_NodeJS_Downloader {\r\nmeta:\r\nid = \"c74b47ef-7105-4382-b4af-80652ad4047d\"\r\nversion = \"1.0\"\r\nintrusion_set = \"Lazarus\"\r\nmalware = \"GolangGhost\"\r\ndescription = \"Detects the NodeJS Downloader\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"7978d40bd5ca56021f6c250f564e7e27\"\r\nstrings:\r\n$ = \"spawn('tar', ['-xf\"\r\n$ = \"/t', 'REG_SZ\"\r\n$ = \"curl/\"\r\ncondition:\r\nuint32be(0) == 0x636f6e73 and\r\nfilesize < 10KB and\r\nall of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--ae0dfc2c-8fc2-418a-a422-54fb0e6fe2ab",
            "created": "2026-06-24T19:55:31.379856Z",
            "modified": "2026-06-24T19:55:31.379856Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_GolangGhost_Compiled {\r\nmeta:\r\nid = \"f0d1d82e-7cb5-4324-8f11-310d0dc26e48\"\r\nversion = \"1.0\"\r\nmalware = \"GolangGhost\"\r\nintrusion_set = \"Lazarus\"\r\ndescription = \"Detects Lazarus compiled Go Backdoor\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nstrings:\r\n$ = \"bits-project/bits/util\"\r\n$ = \"unknown auto mode\"\r\n$ = \"%s.tar.gz\"\r\n$ = \"AutoModeChromeGather\"\r\n$ = \"UUID: %s, URL: %s\"\r\ncondition:\r\n(\r\n(uint16(0) == 0x5a4d) or\r\n(uint32(0)==0x464c457f) or\r\n(uint32(0) == 0xfeedfacf) or\r\n(uint32(0) == 0xcffaedfe) or\r\n(uint32(0) == 0xfeedface) or\r\n(uint32(0) == 0xcefaedfe)\r\n) and 4 of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c72b2c46-7592-4b73-8176-6631cf43b1ce",
            "created": "2026-06-24T19:55:31.38045Z",
            "modified": "2026-06-24T19:55:31.38045Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_Go_Backdoor_strings {\r\nmeta:\r\nid = \"77f85517-2446-4251-a684-10888312f190\"\r\nversion = \"1.0\"\r\nmalware = \"GolangGhost\"\r\nintrusion_set = \"Lazarus\"\r\ndescription = \"Detect's Lazarus Go interpreted Backdoor\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"341ba2e57a0f108be75a1515d32a008a\"\r\nstrings:\r\n$ = \"func processInfo(\"\r\n$ = \"func processUpload(\"\r\n$ = \"func processWait(\"\r\n$ = \"func processOsShell(\"\r\n$ = \"func StartMainLoop(\"\r\ncondition:\r\nuint32be(0) == 0x7061636b and\r\n3 of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--a210ab93-76e0-440c-aca4-5d82289d433d",
            "created": "2026-06-24T19:55:31.381081Z",
            "modified": "2026-06-24T19:55:31.381081Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_NodeVBS_Launcher {\r\nmeta:\r\nid = \"7c869b72-21ff-463c-b12e-cbd629ca8cc6\"\r\nversion = \"1.0\"\r\nintrusion_set = \"Lazarus\"\r\nmalware = \"GolangGhost\"\r\ndescription = \"Detects Node VBS launcher used in the ClickFake campaign\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"ce37c75d35c82f933e14b00f32c25373\"\r\nstrings:\r\n$s = \"objShell.Run \\\"cmd /c node \"\r\ncondition:\r\nuint32be(0) == 0x53657420 and\r\n$s in (filesize-50..filesize)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--f0f05c54-d95d-49b5-9d77-731205731564",
            "created": "2026-06-24T19:55:31.381655Z",
            "modified": "2026-06-24T19:55:31.381655Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_ZIP_with_GolangGhost {\r\nmeta:\r\nid = \"2cfea7bc-ea80-4bf7-b647-364e01a631ff\"\r\nversion = \"1.0\"\r\nintrusion_set = \"Lazarus\"\r\nmalware = \"GolangGhost\"\r\ndescription = \"Detects Lazarus's ZIP file with Go Stealer\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"00b7488d87972e9812e94c69385f6839\"\r\nstrings:\r\n$ = { (9A 18| 84 17) 00 00 [4-12] 2F 63 68 72 6F 6D 65 5F 63 6F 6F 6B 69 65 5F 64 61 72 77 69 6E 2E 67 6F}\r\n$ = { (BF 05 | 36 06) 00 00 [4-12] 2F 62 61 73 69 63 2E 67 }\r\n$ = { (08 24 | 95 22 ) 00 00 [4-12] 2F 63 68 72 6F 6D 65 5F 63 6F 6F 6B 69 65 5F 6F 74 68 65 72 2E 67 6F }\r\ncondition:\r\nuint32be(0) == 0x504b0304 and\r\n1 of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--c3b9186c-626b-44d0-bc61-3f03c3f3f4a8",
            "created": "2026-06-24T19:55:31.382225Z",
            "modified": "2026-06-24T19:55:31.382225Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_JavaScript {\r\nmeta:\r\nid = \"9037b056-c6a9-4089-a30c-377e7461e83e\"\r\nversion = \"1.0\"\r\nintrusion_set = \"Lazarus\"\r\nmalware = \"GolangGhost\"\r\ndescription = \"Detects ReactJS code used in ClickFake campaign\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-20\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"d583a05680e83b5b4c7ac2d21920384b\"\r\nstrings:\r\n$ = \"/invite/${\"\r\n$ = \"inviteUUID\" nocase\r\n$ = \"The content is copied to the clipboard\"\r\n$ = \"react.element\"\r\n$ = \"Interview\" nocase\r\ncondition:\r\nall of them and filesize < 5MB\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--55674019-d9d6-44bc-b833-cd28268bd682",
            "created": "2026-06-24T19:55:31.382792Z",
            "modified": "2026-06-24T19:55:31.382792Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_ClickFake_Interview_FrostyFerret {\r\nmeta:\r\nid = \"12f06933-b0f0-438f-a139-6d0b25ff32e1\"\r\nmalware = \"FrostyFerret\"\r\nintrusion_set = \"Lazarus\"\r\ndescription = \"Detects FrostyFerret based on strings\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-19\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"69bf17d2fb810df08180f0d5b7ce4537\"\r\nstrings:\r\n$ = \"content.dropboxapi.com/2/files/upload\"\r\n$ = \"Failed to get public IP address.\"\r\n$ = \"Failed to convert password to data\"\r\n$ = \"The password you entered is incorrect. Please try again.\"\r\n$ = \"Please enter your password to proceed.\"\r\ncondition:\r\nuint32be(0) == 0xcafebabe and\r\n3 of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d0941261-f4fd-4bcb-9e74-994953443457",
            "created": "2026-06-24T19:55:31.383357Z",
            "modified": "2026-06-24T19:55:31.383357Z",
            "name": "YARA Rule",
            "pattern": "rule apt_Lazarus_MacOs_ClickFake_Interview_bash_installer {\r\nmeta:\r\nid = \"0f59e291-ac25-4e9a-89b8-54ea7015f769\"\r\nintrusion_set = \"Lazarus\"\r\nmalware = \"GolangGhost\"\r\ndescription = \"Detects MacOs installer used in ClickFake Interview campaign\"\r\nsource = \"Sekoia.io\"\r\ncreation_date = \"2025-03-19\"\r\nclassification = \"TLP:GREEN\"\r\nhash = \"2805e6efa8877f5707d8e6b29610894f\"\r\nstrings:\r\n$s0 = \"#!/bin/bash\"\r\n$s1 = \"PLISST_FILE=~/Library/\"\r\n$s2 = \"ZIP_URL=$ZIP_\"\r\n$s3 = \"chmod +x\"\r\ncondition:\r\nfilesize < 5KB and\r\n$s0 at 0 and @s1 < @s2 and @s2 < @s3\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-03-31T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ae8d29af-6ead-4ec2-bf02-1e0717aee8c2",
            "hashes": {
                "MD5": "2805e6efa8877f5707d8e6b29610894f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f3b77451-2b56-4e71-97de-7694eb88b85f",
            "hashes": {
                "MD5": "ce37c75d35c82f933e14b00f32c25373"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cd1871a3-910f-4ba0-b0e8-8f97462273c9",
            "hashes": {
                "MD5": "341ba2e57a0f108be75a1515d32a008a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7bc5611f-71ab-4620-9c37-6666f5f042ea",
            "hashes": {
                "MD5": "69bf17d2fb810df08180f0d5b7ce4537"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5a2903d6-57ce-4314-9e2e-2a5f5e27323c",
            "hashes": {
                "MD5": "d583a05680e83b5b4c7ac2d21920384b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8bfbabb6-a15c-41d6-aeb4-3680c44c7bdb",
            "hashes": {
                "MD5": "7978d40bd5ca56021f6c250f564e7e27"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--635cea9d-5bf0-4bb1-833e-c91ac414d5b9",
            "hashes": {
                "MD5": "00b7488d87972e9812e94c69385f6839"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--400fe37a-4781-4667-8a5a-ee8ee2550ad0",
            "value": "https://api.smartdriverfix.cloud/nvidiawins-update"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--82ffcf1c-1b9e-4545-8bb2-53570a931d06",
            "value": "https://api.smartdriverfix.cloud/coremedia-kp9s.sh"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--fbcb1c93-0885-4380-9385-76bdcd59e779",
            "value": "https://www.archblock.com"
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--39a83e36-f12c-477a-8bed-e70265b3a610",
            "value": "https://api.smartdriverfix.cloud/nvidiadrivers-kp9s.update"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--cefae5b1-a268-4090-9a19-3d18ed527cda",
            "value": "videorecruitpro.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d14ceeac-81ec-4c27-a4da-2e45468a6f74",
            "value": "blockchainjobassessment.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1f5710ea-95cb-4aef-b125-aecbc1dffc6c",
            "value": "skillprooflab.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a98a0d73-7b16-413e-b102-ada92e665629",
            "value": "api.smartdriverfix.cloud"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d4997b85-38d8-42a0-82df-0ef8ce9c2cdd",
            "value": "zenspiretech.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7da07118-cf43-4504-8469-ebe93b39ccab",
            "value": "skillhiretrack.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d78db8ba-2a56-46bb-877a-a3d8a19ef6bc",
            "value": "eskillprof.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7dba75a4-44a8-460c-a7db-47682ba9ff3e",
            "value": "livehirehub.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a52bd374-44db-4c86-9c11-3fff26532a62",
            "value": "blockassess.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--457caf9e-3bee-4c98-b725-e4fa95f3dea0",
            "value": "vidcruiterinterview.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6ecfe6d5-5a2f-4e6b-a86b-d08966a3038e",
            "value": "coinbase-walet.me"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--aaf8ebf1-a8ae-4889-9ea0-c81173ff781e",
            "value": "test-wolf.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--36289d85-bec4-42cf-8e3b-6ca7933d1b89",
            "value": "assessiohq.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--73713a01-9983-47a1-986e-8a4f7b86db1f",
            "value": "devchallengehq.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c13303de-3594-478e-9eb8-4996dae7f63c",
            "value": "quickassessio.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8b04d726-a7c6-46db-8995-ff45f442db82",
            "value": "ugethired360.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d0915dec-afef-4a90-ab89-c508d514f26b",
            "value": "competency-core.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bec4a1f0-08d6-4222-aab8-072cc52ce8b7",
            "value": "intervwolf.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c503abe5-0742-4fe6-a735-e9a441a1f7cd",
            "value": "quickskill-review.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4dd804ac-9d15-447d-8144-5366f3506209",
            "value": "toptalentassess.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--027002c9-c61b-4dca-93cc-b34cb50c9492",
            "value": "coinbase-walet.biz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--df05fafd-8559-4f5b-bfdf-796fde6e62d9",
            "value": "vidassess360.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--84519f9c-30d9-4484-a601-82cad56819da",
            "value": "candidateinsightinfo.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--11df0ffd-8e44-4153-941f-8fd65cd462e0",
            "value": "blockchainjobhub.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8e1bcf20-e64e-45c2-8c12-fc44405b65b8",
            "value": "talentsnaptest.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--30e103c8-a785-4206-9c23-0481bae362e6",
            "value": "talentview360.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4641adca-e349-4d2f-aef9-c35607c65f5a",
            "value": "jobinterview360.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d8ae6fcb-8763-4009-a564-71140a9ad248",
            "value": "quickhire360.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9b4e176c-5751-47c9-9e18-db0d15378d43",
            "hashes": {
                "SHA-256": "a803c043e12a5dac467fae092b75aa08b461b8e9dd4c769cea375ff87287a361"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d801f012-b004-4b7a-a867-326ab0eb162c",
            "hashes": {
                "SHA-256": "e52118fc7fc9b14e5a8d9f61dfae8b140488ae6ec6f01f41d9e16782febad5f2"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--517f1d6a-514b-592b-8216-43a310ad6d08",
            "created": "2026-06-24T19:55:31.402428Z",
            "modified": "2026-06-24T19:55:31.402428Z",
            "name": "ContagiousInterview"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-24T19:55:31.404781Z",
            "modified": "2026-06-24T19:55:31.404781Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4cc5acab-eae9-45e4-ba2f-13a8ca3713c6",
            "created_by_ref": "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
            "created": "2026-06-24T19:55:31.41008Z",
            "modified": "2026-06-24T19:55:31.41008Z",
            "name": "From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic",
            "published": "2025-03-31T00:00:00Z",
            "object_refs": [
                "identity--b2accece-fadb-44a9-be6d-e31c21b885c6",
                "ipv4-addr--14c9cf4a-0953-497d-ba4c-bcd1b67feae5",
                "ipv4-addr--e415e7dc-8310-497b-909e-69413c4db172",
                "domain-name--8ae29832-9016-472d-8632-5263bc0a0d53",
                "domain-name--3cfc541d-692d-4950-9196-5c9b6ab906ae",
                "domain-name--305962b2-5b80-48f1-acef-d6d09a21cd1b",
                "domain-name--28726dbe-ca9b-485f-a3bb-933917a108a7",
                "domain-name--653ad022-9010-4fd3-94a2-9fd16423992e",
                "file--5d62a332-bedc-4c9d-b79c-3de038aa157f",
                "file--11e71e8e-f27a-4526-96b1-b7dc764e3334",
                "file--dc9eecc4-5f74-4f91-b098-c6cb6b2e52e2",
                "file--19a77dbf-4759-4c9f-b065-ef5f21483e41",
                "file--bd57fd24-3b9d-408f-9d42-1ff60935be9d",
                "file--fba560d9-13b8-4a46-b16a-f569802310c8",
                "file--a54cfb95-d216-4fbc-aba5-25a51f6c37d4",
                "file--6db1f49d-551e-4fa2-9c22-37b7c821812b",
                "file--1c210c64-6941-4519-913b-b14e61d04f00",
                "file--003a947f-af1a-4dfd-b54a-7f7ab85930d6",
                "file--cb2fa405-069b-411d-b6c2-7a29dc9bc5a4",
                "domain-name--0c054012-aa97-4339-847b-dcc21b964ea2",
                "domain-name--40077f8b-fa68-4ded-ab70-e6d3cece5358",
                "domain-name--411c9cc7-a09e-4f50-a38c-1b10e1f77415",
                "domain-name--105ac519-1f49-4c93-9a54-929b6fe60ab2",
                "domain-name--0351dcb8-48fb-42c6-9a6e-0885da77c671",
                "ipv4-addr--c7470c39-54ba-4de7-97e9-18c1594b02c2",
                "domain-name--7575ad49-7c43-42dc-9985-6b622826e021",
                "file--7cb28808-cde3-44d6-bca9-f3d5a116cc65",
                "domain-name--41618628-fc53-4a3c-9236-a9f3e50aaea7",
                "domain-name--60c5d1d1-614f-4922-a0c6-75550c8364ec",
                "domain-name--88fd2c55-6865-4fe5-99b8-7704080b0375",
                "indicator--b3901ced-f027-482f-ae8b-ef29b1b3e59a",
                "indicator--ae0dfc2c-8fc2-418a-a422-54fb0e6fe2ab",
                "indicator--c72b2c46-7592-4b73-8176-6631cf43b1ce",
                "indicator--a210ab93-76e0-440c-aca4-5d82289d433d",
                "indicator--f0f05c54-d95d-49b5-9d77-731205731564",
                "indicator--c3b9186c-626b-44d0-bc61-3f03c3f3f4a8",
                "indicator--55674019-d9d6-44bc-b833-cd28268bd682",
                "indicator--d0941261-f4fd-4bcb-9e74-994953443457",
                "file--ae8d29af-6ead-4ec2-bf02-1e0717aee8c2",
                "file--f3b77451-2b56-4e71-97de-7694eb88b85f",
                "file--cd1871a3-910f-4ba0-b0e8-8f97462273c9",
                "file--7bc5611f-71ab-4620-9c37-6666f5f042ea",
                "file--5a2903d6-57ce-4314-9e2e-2a5f5e27323c",
                "file--8bfbabb6-a15c-41d6-aeb4-3680c44c7bdb",
                "file--635cea9d-5bf0-4bb1-833e-c91ac414d5b9",
                "url--400fe37a-4781-4667-8a5a-ee8ee2550ad0",
                "url--82ffcf1c-1b9e-4545-8bb2-53570a931d06",
                "url--fbcb1c93-0885-4380-9385-76bdcd59e779",
                "url--39a83e36-f12c-477a-8bed-e70265b3a610",
                "domain-name--cefae5b1-a268-4090-9a19-3d18ed527cda",
                "domain-name--d14ceeac-81ec-4c27-a4da-2e45468a6f74",
                "domain-name--1f5710ea-95cb-4aef-b125-aecbc1dffc6c",
                "domain-name--a98a0d73-7b16-413e-b102-ada92e665629",
                "domain-name--d4997b85-38d8-42a0-82df-0ef8ce9c2cdd",
                "domain-name--7da07118-cf43-4504-8469-ebe93b39ccab",
                "domain-name--d78db8ba-2a56-46bb-877a-a3d8a19ef6bc",
                "domain-name--7dba75a4-44a8-460c-a7db-47682ba9ff3e",
                "domain-name--a52bd374-44db-4c86-9c11-3fff26532a62",
                "domain-name--457caf9e-3bee-4c98-b725-e4fa95f3dea0",
                "domain-name--6ecfe6d5-5a2f-4e6b-a86b-d08966a3038e",
                "domain-name--aaf8ebf1-a8ae-4889-9ea0-c81173ff781e",
                "domain-name--36289d85-bec4-42cf-8e3b-6ca7933d1b89",
                "domain-name--73713a01-9983-47a1-986e-8a4f7b86db1f",
                "domain-name--c13303de-3594-478e-9eb8-4996dae7f63c",
                "domain-name--8b04d726-a7c6-46db-8995-ff45f442db82",
                "domain-name--d0915dec-afef-4a90-ab89-c508d514f26b",
                "domain-name--bec4a1f0-08d6-4222-aab8-072cc52ce8b7",
                "domain-name--c503abe5-0742-4fe6-a735-e9a441a1f7cd",
                "domain-name--4dd804ac-9d15-447d-8144-5366f3506209",
                "domain-name--027002c9-c61b-4dca-93cc-b34cb50c9492",
                "domain-name--df05fafd-8559-4f5b-bfdf-796fde6e62d9",
                "domain-name--84519f9c-30d9-4484-a601-82cad56819da",
                "domain-name--11df0ffd-8e44-4153-941f-8fd65cd462e0",
                "domain-name--8e1bcf20-e64e-45c2-8c12-fc44405b65b8",
                "domain-name--30e103c8-a785-4206-9c23-0481bae362e6",
                "domain-name--4641adca-e349-4d2f-aef9-c35607c65f5a",
                "domain-name--d8ae6fcb-8763-4009-a564-71140a9ad248",
                "file--9b4e176c-5751-47c9-9e18-db0d15378d43",
                "file--d801f012-b004-4b7a-a867-326ab0eb162c",
                "threat-actor--517f1d6a-514b-592b-8216-43a310ad6d08",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"
                }
            ]
        }
    ]
}