{
    "type": "bundle",
    "id": "bundle--144f093b-6665-450e-898e-b25698f69993",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--04104b6b-5207-4e88-904b-8fec73739552",
            "created": "2026-01-25T08:53:44.226941Z",
            "modified": "2026-01-25T08:53:44.226977Z",
            "name": "WithSecure",
            "identity_class": "organization"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2b6dfbee-400c-410b-85a8-52fba73513ef",
            "value": "share.googlefiledrive.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1406cbe7-f681-468e-865b-4e70f758ea7c",
            "value": "drives.googldrive.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e3631f07-4513-48d1-bf16-b8ca9bc38098",
            "value": "googleexplore.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f7c87998-ab27-4c7a-924c-bbacc52dc9c7",
            "value": "twosigma.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ce5da68c-701c-41f7-8871-c7809e727c47",
            "value": "mail.gdriveupload.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--922920f9-1f5c-4025-8536-8cb5ac24ff04",
            "value": "mail.googleupload.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dee5239a-64f9-4bda-98d7-c9d5f42465cd",
            "value": "googledrive.publicvm.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--905e545c-e2a2-46f7-b06b-751a51414b84",
            "hashes": {
                "SHA-256": "8b6887c5ec6fadaefee78f089e9a347a539bcedf52f5827f866a49a1839f8c4b"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--c190a14b-2fd6-4d81-8018-da7c999d561e",
            "value": "googleupdate.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0596afda-71b9-40cc-a215-7e4d6f037a6d",
            "value": "chromeupdate.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5a937f19-3fba-4b95-a200-6df5b1183014",
            "value": "1driv.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9b9bc0f9-b282-4594-ac15-685ef5f77212",
            "value": "onedriveupdate.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dca2b2a5-0b80-4dbf-b875-b0fde1ce2006",
            "value": "uploadsfiles.xyz"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--121524d7-e11a-4bc2-9939-f6c7f6ca7f7d",
            "value": "66.181.166.15"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--69153373-fdda-435c-a3be-ce0e6395d6c4",
            "value": "drivegooglshare.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b33132d0-0961-46c9-8a6f-bad7c96d9b63",
            "value": "msupdatepms.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--de7554fc-6c21-42ee-9633-1639834a742d",
            "value": "mskpupdate.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d8bce0de-2499-4959-85c4-153b5f1d96f6",
            "value": "drivegoogle.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e2829f59-54ad-4348-b482-1d193c9e5d10",
            "value": "twosigmateam.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b1ab11bf-c2ff-4b35-b9cb-ef2a1f0d697a",
            "value": "name.ownemail.me"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--98cd2434-2db5-40ea-8da8-2a1dc12920d1",
            "value": "mse.theworkpc.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9cc019a9-d917-4f62-ae52-90f8973f8896",
            "value": "office.onedriveglobal.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--79246e80-f07d-4c0f-9ef6-4ff97ae86d25",
            "value": "onedrive.onedriveglobal.com"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--dbb89906-338f-491b-acee-7519583df902",
            "created": "2026-06-24T19:52:23.560983Z",
            "modified": "2026-06-24T19:52:23.560983Z",
            "name": "YARA Rule",
            "pattern": "rule lazarus_network_backdoor_unpacked\r\n{\r\nmeta:\r\nauthor=\"f-secure\"\r\ndescription=\"Detects unpacked variant of Lazarus Group network backdoor\"\r\ndate=\"2020-06-10\"\r\nstrings:\r\n$str_netsh_1 = \"netsh firewall add portopening TCP %d\" ascii wide nocase\r\n$str_netsh_2 = \"netsh firewall delete portopening TCP %d\" ascii wide nocase\r\n$str_mask_1 = \"cmd.exe /c \\\"%s >> %s 2>&1\\\"\" ascii wide\r\nF-Secure.com | \u00a9 F-Secure LABS\r\n\r\n22\r\n\r\n\f\r\n$str_mask_2 = \"cmd.exe /c \\\"%s 2>> %s\\\"\" ascii wide\r\n$str_mask_3 = \"%s\\\\%s\\\\%s\" ascii wide\r\n$str_other_1 = \"perflog.dat\" ascii wide nocase\r\n$str_other_2 = \"perflog.evt\" ascii wide nocase\r\n$str_other_3 = \"cbstc.log\" ascii wide nocase\r\n$str_other_4 = \"LdrGetProcedureAddress\" ascii\r\n$str_other_5 = \"NtProtectVirtualMemory\" asci\r\ncondition:\r\nint16(0) == 0x5a4d\r\nand filesize < 3000KB\r\nand 1 of ($str_netsh*)\r\nand 1 of ($str_mask*)\r\nand 1 of ($str_other*)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-18T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--9f110828-b3a2-4d47-b317-ebd09ce6b7df",
            "created": "2026-06-24T19:52:23.56164Z",
            "modified": "2026-06-24T19:52:23.56164Z",
            "name": "YARA Rule",
            "pattern": "rule lazarus_lssvc_ntuser_unpacked\r\n{\r\nmeta:\r\nauthor=\"f-secure\"\r\ndescription=\"Detects unpacked variant of Lazarus Group implant\"\r\ndate=\"2020-06-10\"\r\nstrings:\r\n$str_curl = \"CLIENT libcurl\" ascii\r\n$str_mask = \"%s%s\\\\%s\" ascii wide fullword\r\n$str_exe_1 = \"explorer.exe\" ascii wide nocase\r\n$str_exe_2 = \"lsass.exe\" ascii wide nocase\r\n$str_misc_ext = \".cid\" ascii wide\r\n$str_misc_debug = \"SeDebugPrivilege\" ascii wide\r\n$str_misc_ntdll = \"NtProtectVirtualMemory\" ascii\r\ncondition:\r\n$str_curl\r\nand $str_mask\r\nand 1 of ($str_exe*)\r\nand 2 of ($str_misc*)\r\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-18T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--1da76ce3-9c93-4c80-b79b-0941952bb0dd",
            "created": "2026-06-24T19:52:23.562217Z",
            "modified": "2026-06-24T19:52:23.562217Z",
            "name": "YARA Rule",
            "pattern": "rule lazarus_rc4_loop\r\n{\r\nmeta:\r\nF-Secure.com | \u00a9 F-Secure LABS\r\n\r\n21\r\n\r\n\f\r\nauthor=\"f-secure \"\r\ndescription=\"Detects RC4 loop in Lazarus Group implant\"\r\ndate=\"2020-06-10\"\r\nstrings:\r\n$str_rc4_loop = { 41 FE 8? 00 01 00 00 45 0F B6 ?? 00 01 00 00 48 FF C? 43 0F\r\nB6 0? ?? 41 00 8? 01 01 00 00 41 0F B6 ?? 01 01 00 00 }\r\ncondition:\r\nint16(0) == 0x5a4d\r\nand filesize < 3000KB\r\nand $str_rc4_loop\r\n}",
            "pattern_type": "yara",
            "valid_from": "2020-08-18T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5da2f6a2-aa5e-4ba8-8760-706ac03d486e",
            "hashes": {
                "SHA-256": "f8915227c25c5ac552d66f3708f615cd517363953829d3715f38666d7dfa9770"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ca7ac6e8-e882-4e04-8618-47f90c14f3f1",
            "hashes": {
                "SHA-256": "72e0965385eae2d3a2f20feb361ce542235fe44c08991644a0a231f595039e68"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2b478a68-a2b1-42ff-b618-06768cdd9095",
            "hashes": {
                "SHA-256": "00efd0888b1772382ff75931ee186cbbcaf6576a0211ac1ab26420484259427a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7d7c0224-a0e2-44e4-82e2-65a16d8101bb",
            "hashes": {
                "SHA-256": "7ad1f7c989d7d8937bf9a1aca255c273a0bede03e6d26f5537971bd264fbadd9"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--991a611c-4e57-413c-a765-e081c091859c",
            "hashes": {
                "SHA-256": "dfa115eec65529d0fa393e154f79323e39ca7667e1b8f99973792a2954047a00"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bc0f3f67-cfdf-4519-9e61-6180939d5466",
            "hashes": {
                "SHA-256": "a2f0a1d469d73a11c69afc9eb12000fa7f7652305d936a10d12dabce693f878b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--d6aa3cee-d54f-4dfe-952b-ba463f3eb36d",
            "hashes": {
                "SHA-256": "519f100ddc98cfb9aca3e13c0095bddeadf11c50397096953171d042ca376fbd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--04cb93d4-ac04-4f36-972e-0fa4341279b1",
            "hashes": {
                "SHA-256": "306deba9a8dbb6f5ab88f2386cbe1d46735231fdc680be65d1b6654b1f9950fc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--934e7ec4-ab88-4d05-b389-3b4b7beb7cc2",
            "hashes": {
                "SHA-256": "09f0e82a3bad997c32605a1d3f9e40a0489b587af188fd05d4506358f2e890b4"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bd1118a9-ffb9-43ea-85a8-81141fa0ebc7",
            "hashes": {
                "SHA-256": "c909d2214af7449e9aabc3dad45465e8786b5aa4d25ed6abffce2fc3d9547b8e"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ed50a42e-ab30-44c5-ab3b-c81018d763e1",
            "hashes": {
                "SHA-256": "ef3c435a184a1f2a756a597967504ae8744184553571620962238e2ac29471ee"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c811edcc-9f14-4c25-91f7-dc718295456f",
            "hashes": {
                "SHA-256": "4786d881b14712866fe9953ad039197e630007ea19c0f0d3bf6c52598e26210c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ee1b2204-2f91-4402-a39c-6e649885e9d0",
            "hashes": {
                "SHA-256": "209c82f38d445ce0750ceeb192c28e6770543a9bda82955f808cb15ca7c56e80"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7af56746-bf7d-4b9e-ab12-03bcb91a4619",
            "hashes": {
                "SHA-256": "831ba6efa4a49eb1c7ff749fe442b393c5a614f383bf1efb52512a183b4362fc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cfe4ae6f-9778-45a9-a90b-e80432546eec",
            "hashes": {
                "SHA-256": "5c8291d7a3bf4e7f958f33ba3cb3fb35218a86ed9c67178ecc458c5d2d5f6203"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ca4cfb6e-fc78-4be4-b35a-7a69e719e18b",
            "hashes": {
                "SHA-256": "4fcd5969811399850fb7d56b82a125f9e43fc2a801bd855de0767abcbed530ad"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2f68b1e5-74eb-4642-811f-1483c4dbf67e",
            "hashes": {
                "SHA-256": "d81471ce32b8109fea01956bc96253f7a53004bafe3ca55df44526d49152736c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2be094a5-64c0-4c2c-bbd4-b99c43339881",
            "hashes": {
                "SHA-256": "a794b496c5f359374c4bde7934dbac1eb067b7b81aff0d586b6f4e9e209eedaf"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a51b5c1f-7d01-4963-9871-f10e92d0bdf5",
            "hashes": {
                "SHA-256": "61da70fc736b7146319928de39109f45e9f3e6ad374db8f9f778b5a3a32ec869"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f040acc4-d304-4558-a0de-ee1649b50f2d",
            "hashes": {
                "SHA-256": "b0dd8c5bc3a8609f4c963c572f92f5a91da663e92e10c26ce385ecb27999db18"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--71870f45-9e5e-45ac-bda5-8da46a2f6c3d",
            "hashes": {
                "SHA-256": "919380f60b8e644ebdf68bbc64dd14e012d50df343bd35881636f0d1ee934f1f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--cfce761a-f85f-4218-b2db-97b3e2fcb9cb",
            "hashes": {
                "SHA-256": "e784a3169431980569d2376c611748b36a28f3f4e4644436846f554c3ef65b30"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--26e3c5b0-2a95-4723-bb20-38ad56b727ca",
            "hashes": {
                "SHA-256": "ae7e1c00018ca7522834072c4adb54be346db63bab8d046d24f975c0b21440dc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--2038e189-52f7-4db7-9b05-50cf078ac2f6",
            "hashes": {
                "SHA-256": "ba54f79c32806b8d7e8f023b8339b1882761eecc3a5f8b9d40ab764bf2ed3f26"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e9c6464e-6013-47b4-919a-69eda89096f1",
            "hashes": {
                "SHA-256": "0f413432d5f4fc1479ea058d6f45c6214f5d1aa6f56a367ace5b86d7ebe31dea"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c9b58888-7eef-432e-8ea0-7d330591400b",
            "hashes": {
                "SHA-256": "e099ae57f9d5b63a8297f958973c650fa5564a022fcfed00bbb67f8993077cab"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--04e80aec-2a99-446c-ba7c-d79605605869",
            "hashes": {
                "SHA-256": "7f60e13ed2e35bb2cfe4e243c71532b65d54f8b61ae7e7e789c125d274cdd3fe"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c500b363-8572-4b8e-ae65-adcff751d3e7",
            "hashes": {
                "SHA-256": "8f924f8cc8457e7e77c791896e4f19ff90d79958a3cfef95b2f77fc8a521bf0c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--42df8992-c0bc-4e8a-a8f4-2444746b5635",
            "hashes": {
                "SHA-256": "994b3b76317cd9f6d5d1777119e102503ba5f354cc2fe19bd471949a029b1770"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--8f9428e7-0359-42c5-9955-7aeb436d57da",
            "hashes": {
                "SHA-256": "a837287bf214666ca214b5530dd56edbd6469e6a6c179a6075dc64422ee5a65f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--5127c003-c609-4a64-a70a-3fa10b0d681d",
            "hashes": {
                "SHA-256": "481629605412b02746f6ed7c102a391a4d8d49bd90f137bb262b723437de0937"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6573d343-3a5d-41d8-8caf-b97475d9c522",
            "hashes": {
                "SHA-256": "25d490dea789a84aaea3b6a94787956e581d1854a2b644c148d93333732c87cc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fbfce360-0860-4def-b2a9-880eed9435ca",
            "hashes": {
                "SHA-256": "b050545a7ffcbbcf96dc79354a6988fcc2f55bc76b67b59eaab36e7d238a7f62"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--723f88f8-91dd-4f22-984b-752b19f08780",
            "hashes": {
                "SHA-256": "439fcbfd868078a4f774c17400c3af9d730458578a8e51c349c2b9848ba2afef"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f8c9fb98-ea71-4b06-8a8a-a169cd5afd55",
            "value": "https://bitly.com/2Dd0psl"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1d7afdfd-79ed-4402-a899-8e4c2a6d957b",
            "value": "wordpress.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--de240914-7ee6-48ce-9860-57505a56b010",
            "value": "down.onedrivrshares.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a6d78ec8-fa0f-49fc-91e7-0f56f664fa0d",
            "value": "map.navicheck.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--221ada7a-9307-4dd1-bacd-72865135b7d7",
            "value": "cryptofund.servehttp.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--59d72393-4158-44a1-afa9-c754e7b4e3fc",
            "value": "blockchaincap.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e2837277-2eb0-419c-8014-89cb488999d4",
            "value": "cloud.bugscrowd.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3fb4e293-e716-4ab8-b4a9-4ebd145aaadf",
            "value": "azcloud.jetos.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--370802b7-b7d0-40bd-a03d-f0162a16a951",
            "value": "antlercap.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3af2a6b4-f0b9-40df-be87-ab2b04dbaf1b",
            "value": "drive.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--71bc35f4-545f-4c1b-88e7-f90293877f6a",
            "value": "code.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9be1af98-55c8-4838-bcc9-3222a1d80f05",
            "value": "luisgarcia.myftp.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--136e354b-7af0-48e9-93b6-eeded9d37dc0",
            "value": "p2p.downefile.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--694e9256-944e-404f-9d08-f0d3053bbf65",
            "value": "open.gdriveshareslink.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a5e8d3ac-e244-4740-bce7-dc35622d8d4f",
            "value": "sequoiacaps.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ebd82060-23db-4f5b-b35e-3363b62da3b2",
            "value": "share.onedriveglobal.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--71faad6a-0841-4725-bb4b-8c8bc651ccad",
            "value": "idgcapital.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f4cb80cc-6bb4-4493-9118-e4be5676d134",
            "value": "icloud-mail.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--eaf01b8c-8c16-4599-b206-50f6fa5b6e20",
            "value": "up.drvupdate.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--70ba8a8a-245d-4ddd-8cc3-e3896ea63c53",
            "value": "share.goglesheet.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8ed3ba0c-7f7e-48d6-9755-957b8ffef102",
            "value": "toyota-ai.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--48d174ff-9fcb-4026-88cd-b1076d647784",
            "value": "waterm.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3c412ecd-5bbb-4ed5-bc09-bc0c19da61e4",
            "value": "store.onedriveglobal.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--650b9e4c-c9b6-4564-9a7e-03f84cbe5d2d",
            "value": "matrix-partners.theworkpc.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0a599a63-17bc-45b3-812f-d140282a424b",
            "value": "sequoiacapitals.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--61ae69f8-441e-49d0-bf7a-8e293e6f2094",
            "value": "cryptostore.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4099e313-9ec7-4534-86d1-7350786b4a6c",
            "value": "sshare.onedriveglobal.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--b07a5396-75a5-49fe-8e11-78010d0e3c4f",
            "value": "twosigma.theworkpc.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a494a2be-79db-4c6e-a949-7da62801c4b1",
            "value": "twosigma.linkpc.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--02f7c65a-e929-4c2e-a102-6c12f01faf00",
            "value": "reghelp.webredirect.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--dcd0b14c-4fe7-4d78-8b6f-66eec65039b4",
            "value": "drivegoogles.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e0d02109-50af-4769-87aa-74c388fadce7",
            "value": "docs.googledrives.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9400a665-8b77-418f-9edb-3f55e7211e83",
            "value": "downloadsvc.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7541e307-9ae2-4f68-b0dc-f383762dad1a",
            "value": "sendgrid.webredirect.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0efad362-2ccd-42d5-b9f5-2f9672685d6e",
            "value": "robugnito.publicvm.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--aac854f2-29e7-4324-9e09-0b9d80140ba0",
            "value": "cloudssl.dns-cloud.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3f7c9381-d235-461b-9318-3dedb6f1620f",
            "value": "doc.uploadsfiles.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--53e3bd99-8829-499f-9f01-27574688c782",
            "value": "al6z.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--04eb7233-8ca6-457a-b723-e06ff26f4d05",
            "value": "bourncap.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--e3e7fedf-ad9e-4037-9d24-1b37115b39f1",
            "value": "95.0.200.212"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--dafdbb22-f8ea-46bc-9fd0-d2c6b5d77aa5",
            "value": "200.4.220.172"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--70e94232-f59e-48bc-b155-d3de647ee76d",
            "value": "103.5.124.94"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--19b424b8-c7a0-40ad-bb10-4ae8ef7c555e",
            "value": "75.146.197.161"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--f181b9bb-91b2-453c-9390-47884fc0eaf5",
            "value": "114.113.63.130"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--73e5c253-c187-404e-80b2-597f756f0f14",
            "value": "103.95.99.3"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--124974ef-e798-44d1-9bdc-2a28aaff6975",
            "value": "microsoft-update10v.amazonaws1.info"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--6f65a06f-81a4-498e-b222-fe8aa0444d3c",
            "value": "check.onedrvdn.co"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--68ef1e58-e53a-4721-9e8e-5457469c2f52",
            "value": "support.gdrvcheck.co"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--09c9d490-0b7b-42a8-a0ee-e3b91ff8b5d2",
            "value": "scloud.wechart.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--397b7ff8-afec-4325-b852-a5a2f9c1ddfb",
            "value": "gdocs.googleupload.info"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9ce66f73-0707-403f-a1d7-19a23cd41506",
            "hashes": {
                "SHA-256": "a50ec2f42bec1c43e952de2728de0217f178440bdd8fcef70bb6db4c27e9b4bb"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--584aa683-8bf4-40bb-b7cb-87648e3ec0e9",
            "hashes": {
                "SHA-256": "1533374acf886bc3015c4cba3da1c67e67111c22d00a8bbf7694c5394b91b9fc"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--3d4064a4-a542-43cc-8636-0d8acd39a497",
            "hashes": {
                "SHA-256": "a464781b616c86bbd68dbf909826444f7fd6c6ae378caf074926df7aebc4e3a1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--59b56420-7725-4566-883f-1cb142115e5c",
            "hashes": {
                "SHA-256": "997c4f7695a6a615da069d5f839582fdb83f215bc999e8af492636b2b5e3436c"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--509acbbb-d7c2-459f-a36c-294542d25119",
            "hashes": {
                "SHA-256": "7446efa798cfa7908e78e7fb2bf3ac57486be4d2edea8a798683c949d504dee6"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--af4d9212-144a-45cb-936e-5784702c09ec",
            "value": "gbackup.gogleshare.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--a826b937-9e22-4a88-bd0d-c283b6fc7b9e",
            "value": "eu.euprotect.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--f4d77425-7d22-4ae1-ab9c-95df9d230b78",
            "value": "drive.gogleshare.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5964172e-fa9e-4b88-b20a-ba18fe35bb3e",
            "value": "download.showprice.xyz"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--bb8f74a5-3d29-4818-a37d-bd150dca8163",
            "value": "googldocs.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--d75fdc4c-cea7-49ac-aac1-037f8b05a20a",
            "value": "drverify.dns-cloud.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1b1ccecb-5a8a-49d1-94f4-e1158caa291e",
            "value": "europasec.dnsabr.com"
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-24T19:52:23.611288Z",
            "modified": "2026-06-24T19:52:23.611288Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--b1623300-a364-4dae-aca0-cd748d7e9ea4",
            "created_by_ref": "identity--04104b6b-5207-4e88-904b-8fec73739552",
            "created": "2026-06-24T19:52:23.638613Z",
            "modified": "2026-06-24T19:52:23.638613Z",
            "name": "Lazarus group Campaign Targeting The Cryptocurrency Vertical",
            "published": "2020-08-18T00:00:00Z",
            "object_refs": [
                "identity--04104b6b-5207-4e88-904b-8fec73739552",
                "domain-name--2b6dfbee-400c-410b-85a8-52fba73513ef",
                "domain-name--1406cbe7-f681-468e-865b-4e70f758ea7c",
                "domain-name--e3631f07-4513-48d1-bf16-b8ca9bc38098",
                "domain-name--f7c87998-ab27-4c7a-924c-bbacc52dc9c7",
                "domain-name--ce5da68c-701c-41f7-8871-c7809e727c47",
                "domain-name--922920f9-1f5c-4025-8536-8cb5ac24ff04",
                "domain-name--dee5239a-64f9-4bda-98d7-c9d5f42465cd",
                "file--905e545c-e2a2-46f7-b06b-751a51414b84",
                "domain-name--c190a14b-2fd6-4d81-8018-da7c999d561e",
                "domain-name--0596afda-71b9-40cc-a215-7e4d6f037a6d",
                "domain-name--5a937f19-3fba-4b95-a200-6df5b1183014",
                "domain-name--9b9bc0f9-b282-4594-ac15-685ef5f77212",
                "domain-name--dca2b2a5-0b80-4dbf-b875-b0fde1ce2006",
                "ipv4-addr--121524d7-e11a-4bc2-9939-f6c7f6ca7f7d",
                "domain-name--69153373-fdda-435c-a3be-ce0e6395d6c4",
                "domain-name--b33132d0-0961-46c9-8a6f-bad7c96d9b63",
                "domain-name--de7554fc-6c21-42ee-9633-1639834a742d",
                "domain-name--d8bce0de-2499-4959-85c4-153b5f1d96f6",
                "domain-name--e2829f59-54ad-4348-b482-1d193c9e5d10",
                "domain-name--b1ab11bf-c2ff-4b35-b9cb-ef2a1f0d697a",
                "domain-name--98cd2434-2db5-40ea-8da8-2a1dc12920d1",
                "domain-name--9cc019a9-d917-4f62-ae52-90f8973f8896",
                "domain-name--79246e80-f07d-4c0f-9ef6-4ff97ae86d25",
                "indicator--dbb89906-338f-491b-acee-7519583df902",
                "indicator--9f110828-b3a2-4d47-b317-ebd09ce6b7df",
                "indicator--1da76ce3-9c93-4c80-b79b-0941952bb0dd",
                "file--5da2f6a2-aa5e-4ba8-8760-706ac03d486e",
                "file--ca7ac6e8-e882-4e04-8618-47f90c14f3f1",
                "file--2b478a68-a2b1-42ff-b618-06768cdd9095",
                "file--7d7c0224-a0e2-44e4-82e2-65a16d8101bb",
                "file--991a611c-4e57-413c-a765-e081c091859c",
                "file--bc0f3f67-cfdf-4519-9e61-6180939d5466",
                "file--d6aa3cee-d54f-4dfe-952b-ba463f3eb36d",
                "file--04cb93d4-ac04-4f36-972e-0fa4341279b1",
                "file--934e7ec4-ab88-4d05-b389-3b4b7beb7cc2",
                "file--bd1118a9-ffb9-43ea-85a8-81141fa0ebc7",
                "file--ed50a42e-ab30-44c5-ab3b-c81018d763e1",
                "file--c811edcc-9f14-4c25-91f7-dc718295456f",
                "file--ee1b2204-2f91-4402-a39c-6e649885e9d0",
                "file--7af56746-bf7d-4b9e-ab12-03bcb91a4619",
                "file--cfe4ae6f-9778-45a9-a90b-e80432546eec",
                "file--ca4cfb6e-fc78-4be4-b35a-7a69e719e18b",
                "file--2f68b1e5-74eb-4642-811f-1483c4dbf67e",
                "file--2be094a5-64c0-4c2c-bbd4-b99c43339881",
                "file--a51b5c1f-7d01-4963-9871-f10e92d0bdf5",
                "file--f040acc4-d304-4558-a0de-ee1649b50f2d",
                "file--71870f45-9e5e-45ac-bda5-8da46a2f6c3d",
                "file--cfce761a-f85f-4218-b2db-97b3e2fcb9cb",
                "file--26e3c5b0-2a95-4723-bb20-38ad56b727ca",
                "file--2038e189-52f7-4db7-9b05-50cf078ac2f6",
                "file--e9c6464e-6013-47b4-919a-69eda89096f1",
                "file--c9b58888-7eef-432e-8ea0-7d330591400b",
                "file--04e80aec-2a99-446c-ba7c-d79605605869",
                "file--c500b363-8572-4b8e-ae65-adcff751d3e7",
                "file--42df8992-c0bc-4e8a-a8f4-2444746b5635",
                "file--8f9428e7-0359-42c5-9955-7aeb436d57da",
                "file--5127c003-c609-4a64-a70a-3fa10b0d681d",
                "file--6573d343-3a5d-41d8-8caf-b97475d9c522",
                "file--fbfce360-0860-4def-b2a9-880eed9435ca",
                "file--723f88f8-91dd-4f22-984b-752b19f08780",
                "url--f8c9fb98-ea71-4b06-8a8a-a169cd5afd55",
                "domain-name--1d7afdfd-79ed-4402-a899-8e4c2a6d957b",
                "domain-name--de240914-7ee6-48ce-9860-57505a56b010",
                "domain-name--a6d78ec8-fa0f-49fc-91e7-0f56f664fa0d",
                "domain-name--221ada7a-9307-4dd1-bacd-72865135b7d7",
                "domain-name--59d72393-4158-44a1-afa9-c754e7b4e3fc",
                "domain-name--e2837277-2eb0-419c-8014-89cb488999d4",
                "domain-name--3fb4e293-e716-4ab8-b4a9-4ebd145aaadf",
                "domain-name--370802b7-b7d0-40bd-a03d-f0162a16a951",
                "domain-name--3af2a6b4-f0b9-40df-be87-ab2b04dbaf1b",
                "domain-name--71bc35f4-545f-4c1b-88e7-f90293877f6a",
                "domain-name--9be1af98-55c8-4838-bcc9-3222a1d80f05",
                "domain-name--136e354b-7af0-48e9-93b6-eeded9d37dc0",
                "domain-name--694e9256-944e-404f-9d08-f0d3053bbf65",
                "domain-name--a5e8d3ac-e244-4740-bce7-dc35622d8d4f",
                "domain-name--ebd82060-23db-4f5b-b35e-3363b62da3b2",
                "domain-name--71faad6a-0841-4725-bb4b-8c8bc651ccad",
                "domain-name--f4cb80cc-6bb4-4493-9118-e4be5676d134",
                "domain-name--eaf01b8c-8c16-4599-b206-50f6fa5b6e20",
                "domain-name--70ba8a8a-245d-4ddd-8cc3-e3896ea63c53",
                "domain-name--8ed3ba0c-7f7e-48d6-9755-957b8ffef102",
                "domain-name--48d174ff-9fcb-4026-88cd-b1076d647784",
                "domain-name--3c412ecd-5bbb-4ed5-bc09-bc0c19da61e4",
                "domain-name--650b9e4c-c9b6-4564-9a7e-03f84cbe5d2d",
                "domain-name--0a599a63-17bc-45b3-812f-d140282a424b",
                "domain-name--61ae69f8-441e-49d0-bf7a-8e293e6f2094",
                "domain-name--4099e313-9ec7-4534-86d1-7350786b4a6c",
                "domain-name--b07a5396-75a5-49fe-8e11-78010d0e3c4f",
                "domain-name--a494a2be-79db-4c6e-a949-7da62801c4b1",
                "domain-name--02f7c65a-e929-4c2e-a102-6c12f01faf00",
                "domain-name--dcd0b14c-4fe7-4d78-8b6f-66eec65039b4",
                "domain-name--e0d02109-50af-4769-87aa-74c388fadce7",
                "domain-name--9400a665-8b77-418f-9edb-3f55e7211e83",
                "domain-name--7541e307-9ae2-4f68-b0dc-f383762dad1a",
                "domain-name--0efad362-2ccd-42d5-b9f5-2f9672685d6e",
                "domain-name--aac854f2-29e7-4324-9e09-0b9d80140ba0",
                "domain-name--3f7c9381-d235-461b-9318-3dedb6f1620f",
                "domain-name--53e3bd99-8829-499f-9f01-27574688c782",
                "domain-name--04eb7233-8ca6-457a-b723-e06ff26f4d05",
                "ipv4-addr--e3e7fedf-ad9e-4037-9d24-1b37115b39f1",
                "ipv4-addr--dafdbb22-f8ea-46bc-9fd0-d2c6b5d77aa5",
                "ipv4-addr--70e94232-f59e-48bc-b155-d3de647ee76d",
                "ipv4-addr--19b424b8-c7a0-40ad-bb10-4ae8ef7c555e",
                "ipv4-addr--f181b9bb-91b2-453c-9390-47884fc0eaf5",
                "ipv4-addr--73e5c253-c187-404e-80b2-597f756f0f14",
                "domain-name--124974ef-e798-44d1-9bdc-2a28aaff6975",
                "domain-name--6f65a06f-81a4-498e-b222-fe8aa0444d3c",
                "domain-name--68ef1e58-e53a-4721-9e8e-5457469c2f52",
                "domain-name--09c9d490-0b7b-42a8-a0ee-e3b91ff8b5d2",
                "domain-name--397b7ff8-afec-4325-b852-a5a2f9c1ddfb",
                "file--9ce66f73-0707-403f-a1d7-19a23cd41506",
                "file--584aa683-8bf4-40bb-b7cb-87648e3ec0e9",
                "file--3d4064a4-a542-43cc-8636-0d8acd39a497",
                "file--59b56420-7725-4566-883f-1cb142115e5c",
                "file--509acbbb-d7c2-459f-a36c-294542d25119",
                "domain-name--af4d9212-144a-45cb-936e-5784702c09ec",
                "domain-name--a826b937-9e22-4a88-bd0d-c283b6fc7b9e",
                "domain-name--f4d77425-7d22-4ae1-ab9c-95df9d230b78",
                "domain-name--5964172e-fa9e-4b88-b20a-ba18fe35bb3e",
                "domain-name--bb8f74a5-3d29-4818-a37d-bd150dca8163",
                "domain-name--d75fdc4c-cea7-49ac-aac1-037f8b05a20a",
                "domain-name--1b1ccecb-5a8a-49d1-94f4-e1158caa291e",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf"
                }
            ]
        }
    ]
}