{
    "type": "bundle",
    "id": "bundle--17264129-2484-47ea-b103-6f46aa2d0c25",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--60cb6a34-4e05-49c1-bb42-0e45dd948a20",
            "created": "2025-09-01T13:54:43.426929Z",
            "modified": "2025-09-01T13:59:04.85352Z",
            "name": "Foxit",
            "identity_class": "organization"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--76c75d43-6ec4-4976-b786-282a02f2601b",
            "hashes": {
                "MD5": "85766786fd00957737f1c88632ab9e0d",
                "SHA-1": "3142704d014ed89d1b4d538b6aa796bd371b6990",
                "SHA-256": "7a05188ab0129b0b4f38e2e7599c5c52149ce0131140db33feb251d926428d68"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6372bed2-cb11-44ab-a676-4399d5f82e3f",
            "hashes": {
                "MD5": "23c2569a65870a9e412d98d5b3bdc554",
                "SHA-1": "91def0a4dd9b35510d7f8897bc114f975a5d7e2b",
                "SHA-256": "159471e1abc9adf6733af9d24781fbf27a776b81d182901c2e04e28f3fe2e6f3"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--e54f765e-5e1d-4d44-98de-275c5af513f8",
            "value": "aes-secure.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--847e3c57-9044-4f6f-b61a-c854bfa3ea04",
            "value": "azureglobalaccelerator.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e1ff6cf1-8c09-4ed0-91b6-11cba00a1b91",
            "hashes": {
                "SHA-256": "ff32bc1c756d560d8a9815db458f438d63b1dcb7e9930ef5b8639a55fa7762c9"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--06d459a2-ef27-4e09-b3d8-00f9c162b659",
            "value": "calendly.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--a4f67d87-f8e4-47e2-a951-0985a4dbf78e",
            "hashes": {
                "SHA-256": "85045d9898d28c9cdc4ed0ca5d76eceb457d741c5ca84bb753dde1bea980b516"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fcc06304-3f3e-4f2b-9907-2c7d3ca08331",
            "hashes": {
                "SHA-256": "24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a"
            }
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--4f03d35c-7233-4904-9917-660e9bc48f4b",
            "created": "2026-06-24T20:53:28.552411Z",
            "modified": "2026-06-24T20:53:28.552411Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_ThemeForestRAT_RC4_key {\r\nmeta:\r\ndescription = \"ThemeForest RC4 key used for config file.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$rc4_key = { 20 1A 19 2D 83 8F 48 53 E3 00 }\r\n$rc4_key_mov = { 20 1A 19 2D [2-8] 83 8F 48 53 [2-10] E3 00 }\r\ncondition:\r\nany of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--77c465c0-44c1-44d7-b6f2-bf774cca1501",
            "created": "2026-06-24T20:53:28.55311Z",
            "modified": "2026-06-24T20:53:28.55311Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_ThemeForestRAT_C2_strings {\r\nmeta:\r\ndescription = \"ThemeForestRAT strings used for C2.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$themeforest = \"ThemeForest_%s\" ascii wide\r\n$thumb = \"Thumb_%s\" ascii wide\r\n$param_code = \"code\" ascii wide\r\n$param_fn = \"fn\" ascii wide\r\n$param_ldf = \"ldf\" ascii wide\r\ncondition:\r\nall of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--d5386c3d-44a8-424d-90ee-e6a8120ddd9c",
            "created": "2026-06-24T20:53:28.553697Z",
            "modified": "2026-06-24T20:53:28.553697Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_PerfhLoader_XOR_key {\r\nmeta:\r\ndescription = \"XOR key used for shellcode obfuscation.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$mov_1 = { C7 [1-3] 00 01 02 03 }\r\n$mov_2 = { C7 [1-3] 04 05 06 07 }\r\n$mov_3 = { C7 [1-3] 08 09 0A 0B }\r\n$mov_4 = { C7 [1-3] 0C 0D 0E 0F }\r\n$init_1 = { 41 8D ?? FD 41 8D ?? F9 }\r\ncondition:\r\nall of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--b912c785-3e1d-41bf-8cd7-479197da57b7",
            "created": "2026-06-24T20:53:28.554273Z",
            "modified": "2026-06-24T20:53:28.554273Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_RemotePE_class_strings {\r\nmeta:\r\ndescription = \"RemotePE class strings.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$a = \"IMiddleController\" ascii wide xor\r\n$b = \"IChannelController\" ascii wide xor\r\n$c = \"IConfigProfile\" ascii wide xor\r\n$d = \"IKernelModule\" ascii wide xor\r\ncondition:\r\nall of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--75d492f0-ab93-48b8-bc1c-536d3343e560",
            "created": "2026-06-24T20:53:28.554848Z",
            "modified": "2026-06-24T20:53:28.554848Z",
            "name": "YARA Rule",
            "pattern": "rule Lazarus_RemotePE_C2_strings {\r\nmeta:\r\ndescription = \"RemotePE strings used for C2.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$a = \"MicrosoftApplicationsTelemetryDeviceId\" wide ascii xor\r\n$b = \"armAuthorization\" wide ascii xor\r\n$c = \"ai_session\" wide ascii xor\r\ncondition:\r\nuint16(0) == 0x5A4D and all of them\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "indicator",
            "spec_version": "2.1",
            "id": "indicator--9f7d85af-b57c-49f8-a594-2a40f5d972f2",
            "created": "2026-06-24T20:53:28.555419Z",
            "modified": "2026-06-24T20:53:28.555419Z",
            "name": "YARA Rule",
            "pattern": "import \"pe\"\r\nrule Lazarus_DPAPILoader_Hunting {\r\nmeta:\r\ndescription = \"Hunting rule to detect DPAPILoader, a loader used to load RemotePE.\"\r\nauthor = \"Fox-IT / NCC Group\"\r\nstrings:\r\n$msg_1 = \"[!] Could not allocate memory at the desired base!\\n\"\r\n$msg_2 = \"[!] Virtual section size is out ouf bounds: \"\r\n$msg_3 = \"[!] Invalid relocDir pointer\\n\"\r\n$msg_4 = \"[-] Not supported relocations format at %d: %d\\n\"\r\n$msg_5 = \"[!] Cannot fill imports into 32 bit PE via 64 bit loader!\\n\"\r\ncondition:\r\nany of them and pe.imports(\"Crypt32.dll\", \"CryptUnprotectData\")\r\n}",
            "pattern_type": "yara",
            "valid_from": "2025-09-01T00:00:00Z"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f03ac82a-6e06-4e5f-a1c0-7a86efcb82cd",
            "hashes": {
                "SHA-256": "6510d460395ca3643133817b40d9df4fa0d9dbe8e60b514fdc2d4e26b567dfbd"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--9fdf1581-b034-4148-aa5b-7ed29e6f6c33",
            "hashes": {
                "SHA-256": "59a651dfce580d28d17b2f716878a8eff8d20152b364cf873111451a55b7224d"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--0458e9c7-4546-4d21-9fe7-1911b16b7c20",
            "hashes": {
                "SHA-256": "9dddf5a1d32e3ba7cc27f1006a843bfd4bc34fa8a149bcc522f27bda8e95db14"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--43b8ec1f-e8d2-4c9f-8558-01a1954bd9b2",
            "hashes": {
                "SHA-256": "4f6ae0110cf652264293df571d66955f7109e3424a070423b5e50edc3eb43874"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7883b55c-8f00-4a47-8ef0-976a197f1597",
            "hashes": {
                "SHA-256": "1a051e4a3b62cd2d4f175fb443f5172da0b40af27c5d1ffae21fde13536dd3e1"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--80a7d080-39c2-4a6f-9e97-5296a42bf7ef",
            "hashes": {
                "SHA-256": "f4d8e1a687e7f7336162d3caed9b25d9d3e6cfe75c89495f75a92ca87025374b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--fd1b47ea-3887-4b3e-b32f-5a5b288bb369",
            "hashes": {
                "SHA-256": "aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e3da22a2-2245-4a05-a85d-c20098c55d74",
            "hashes": {
                "SHA-256": "8c3c8f24dc0c1d165f14e5a622a1817af4336904a3aabeedee3095098192d91f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--93672ab0-0a4d-44b6-9bba-1111d6fef5d4",
            "hashes": {
                "SHA-256": "3c8f5cc608e3a4a755fe1a2b099154153fb7a88e581f3b122777da399e698cca"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f0871e6b-7e93-447d-930c-ad12f945c575",
            "hashes": {
                "MD5": "6f2f61783a4a59449db4ba37211fa331"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7d094fd2-887d-401b-bf76-6c3bd149c762",
            "hashes": {
                "SHA-256": "e4ce73b4dbbd360a17f482abcae2d479bc95ea546d67ec257785fa51872b2e3f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--e894e4b7-1dc4-4951-819f-0c983d1fecce",
            "hashes": {
                "SHA-256": "cc4c18fefb61ec5b3c69c31beaa07a4918e0b0184cb43447f672f62134eb402b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--679d10b2-6f00-4b36-843d-aec909912223",
            "hashes": {
                "SHA-256": "37f5afb9ed3761e73feb95daceb7a1fdbb13c8b5fc1a2ba22e0ef7994c7920ef"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--bacebddf-2ded-49a5-93de-68be75d0f4d0",
            "hashes": {
                "SHA-256": "4715e5522fc91a423a5fcad397b571c5654dc0c4202459fdca06841eba1ae9b3"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--34fdb48e-b422-4d8f-bdf7-549ea2ff16bd",
            "hashes": {
                "MD5": "7cc55f3cc2740e8818648efbec21615f"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--ca93c61b-7b81-4a49-9fab-4ff7c4d3d18d",
            "hashes": {
                "MD5": "435c7b4fd5e1eaafcb5826a7e7c16a83"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--c84aa641-de89-41fe-bc8f-36f1265df90b",
            "hashes": {
                "SHA-256": "c66ba5c68ba12eaf045ed415dfa72ec5d7174970e91b45fda9ebb32e0a37784a"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--7a9f5982-df0e-4be5-b7d0-382f6ddecb57",
            "hashes": {
                "SHA-256": "2c164237de4d5904a66c71843529e37cea5418cdcbc993278329806d97a336a5"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--51a2f213-2cf2-46ea-95c7-2e8c3a845e8a",
            "hashes": {
                "SHA-256": "d998de6e40637188ccbb8ab4a27a1e76f392cb23df5a6a242ab9df8ee4ab3936"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--26721005-95b9-4d26-b9fa-fb140979b6e7",
            "hashes": {
                "SHA-256": "774c71664d5d25775478607e74555462773e525e18237947355228337f433a3b"
            }
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--6b5c7f46-e357-42f7-8fc4-063aba79f632",
            "hashes": {
                "SHA-256": "f0321c93c93fa162855f8ea4356628eef7f528449204f42fbfa002955a0ba528"
            }
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--6f579e33-446d-4ce0-b58e-515319110434",
            "value": "https://aluigi.altervista.org/mytoolz.htm"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--394ac8d1-379d-4fa3-8102-7cebce5964ba",
            "value": "dpkgrepo.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--de0e6ebd-0bd8-450e-8017-b77f578b62a5",
            "value": "azuredeploypackages.net"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--9494ff07-f1eb-4211-b1ba-bbb09239b60a",
            "value": "aluigi.altervista.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--82b07f21-749b-4627-a250-08f314d07615",
            "value": "pypilibrary.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--50091e96-244a-4a65-833b-9824e6fcbc3e",
            "value": "oncehub.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--51ee3d2c-3784-40fe-be6b-0b8ad54bb356",
            "value": "go.oncehub.co"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--7f3fb6b2-20b2-4d84-ae66-9890028a38dd",
            "value": "lmaxtrd.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--4de9e293-67b5-4957-8067-4761780706a8",
            "value": "picktime.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--5abdcecc-410a-422d-9d36-af6118ecd11b",
            "value": "nansenpro.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--74d6ba47-6e1a-4bab-97c6-20091af71546",
            "value": "pypistorage.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--ebdde75e-723c-4790-91fd-8dddc113677e",
            "value": "latamics.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--0c4136c5-6d42-40c6-bc31-99a3f0cdc845",
            "value": "oncehub.co"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--8dfd75b8-20c2-46ce-8345-e924e91e2bf4",
            "value": "paxosfuture.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1752c84c-78fb-48cd-b688-a1920cc6b9b5",
            "value": "keondigital.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--36db19b9-6ae5-4f88-b84b-945a050f2698",
            "value": "ftxstock.com"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--8836e09a-7ebf-4400-8443-d9e5ddace6db",
            "value": "192.52.166.253"
        },
        {
            "type": "ipv4-addr",
            "spec_version": "2.1",
            "id": "ipv4-addr--9c4d9685-30b5-4b86-9e47-e7bb54294846",
            "value": "144.172.74.120"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--f9c4a0d3-0f52-44a7-aa16-a55a03a81276",
            "hashes": {
                "SHA-256": "973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c"
            }
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--2a2c7d0e-b09c-4dc5-8fc1-6f442f44c07a",
            "value": "arcashop.org"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--3e93ea5f-8918-45aa-ad20-f83002a53332",
            "value": "jdkgradle.com"
        },
        {
            "type": "domain-name",
            "spec_version": "2.1",
            "id": "domain-name--1d7f16b8-8489-4d1e-b31f-27d4ffda57d4",
            "value": "slowmist.medium.com"
        },
        {
            "type": "file",
            "spec_version": "2.1",
            "id": "file--732d8ec8-b53c-4241-a66d-f623ed76fe8a",
            "hashes": {
                "SHA-256": "5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8"
            }
        },
        {
            "type": "threat-actor",
            "spec_version": "2.1",
            "id": "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b",
            "created": "2026-06-24T20:53:28.57797Z",
            "modified": "2026-06-24T20:53:28.57797Z",
            "name": "Lazarus"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--acb5b37f-ef46-4b6a-83bc-766d16bf92b5",
            "created_by_ref": "identity--60cb6a34-4e05-49c1-bb42-0e45dd948a20",
            "created": "2026-06-24T20:53:28.58453Z",
            "modified": "2026-06-24T20:53:28.58453Z",
            "name": "Three Lazarus RATs coming for your cheese",
            "published": "2025-09-01T00:00:00Z",
            "object_refs": [
                "identity--60cb6a34-4e05-49c1-bb42-0e45dd948a20",
                "file--76c75d43-6ec4-4976-b786-282a02f2601b",
                "file--6372bed2-cb11-44ab-a676-4399d5f82e3f",
                "domain-name--e54f765e-5e1d-4d44-98de-275c5af513f8",
                "domain-name--847e3c57-9044-4f6f-b61a-c854bfa3ea04",
                "file--e1ff6cf1-8c09-4ed0-91b6-11cba00a1b91",
                "domain-name--06d459a2-ef27-4e09-b3d8-00f9c162b659",
                "file--a4f67d87-f8e4-47e2-a951-0985a4dbf78e",
                "file--fcc06304-3f3e-4f2b-9907-2c7d3ca08331",
                "indicator--4f03d35c-7233-4904-9917-660e9bc48f4b",
                "indicator--77c465c0-44c1-44d7-b6f2-bf774cca1501",
                "indicator--d5386c3d-44a8-424d-90ee-e6a8120ddd9c",
                "indicator--b912c785-3e1d-41bf-8cd7-479197da57b7",
                "indicator--75d492f0-ab93-48b8-bc1c-536d3343e560",
                "indicator--9f7d85af-b57c-49f8-a594-2a40f5d972f2",
                "file--f03ac82a-6e06-4e5f-a1c0-7a86efcb82cd",
                "file--9fdf1581-b034-4148-aa5b-7ed29e6f6c33",
                "file--0458e9c7-4546-4d21-9fe7-1911b16b7c20",
                "file--43b8ec1f-e8d2-4c9f-8558-01a1954bd9b2",
                "file--7883b55c-8f00-4a47-8ef0-976a197f1597",
                "file--80a7d080-39c2-4a6f-9e97-5296a42bf7ef",
                "file--fd1b47ea-3887-4b3e-b32f-5a5b288bb369",
                "file--e3da22a2-2245-4a05-a85d-c20098c55d74",
                "file--93672ab0-0a4d-44b6-9bba-1111d6fef5d4",
                "file--f0871e6b-7e93-447d-930c-ad12f945c575",
                "file--7d094fd2-887d-401b-bf76-6c3bd149c762",
                "file--e894e4b7-1dc4-4951-819f-0c983d1fecce",
                "file--679d10b2-6f00-4b36-843d-aec909912223",
                "file--bacebddf-2ded-49a5-93de-68be75d0f4d0",
                "file--34fdb48e-b422-4d8f-bdf7-549ea2ff16bd",
                "file--ca93c61b-7b81-4a49-9fab-4ff7c4d3d18d",
                "file--c84aa641-de89-41fe-bc8f-36f1265df90b",
                "file--7a9f5982-df0e-4be5-b7d0-382f6ddecb57",
                "file--51a2f213-2cf2-46ea-95c7-2e8c3a845e8a",
                "file--26721005-95b9-4d26-b9fa-fb140979b6e7",
                "file--6b5c7f46-e357-42f7-8fc4-063aba79f632",
                "url--6f579e33-446d-4ce0-b58e-515319110434",
                "domain-name--394ac8d1-379d-4fa3-8102-7cebce5964ba",
                "domain-name--de0e6ebd-0bd8-450e-8017-b77f578b62a5",
                "domain-name--9494ff07-f1eb-4211-b1ba-bbb09239b60a",
                "domain-name--82b07f21-749b-4627-a250-08f314d07615",
                "domain-name--50091e96-244a-4a65-833b-9824e6fcbc3e",
                "domain-name--51ee3d2c-3784-40fe-be6b-0b8ad54bb356",
                "domain-name--7f3fb6b2-20b2-4d84-ae66-9890028a38dd",
                "domain-name--4de9e293-67b5-4957-8067-4761780706a8",
                "domain-name--5abdcecc-410a-422d-9d36-af6118ecd11b",
                "domain-name--74d6ba47-6e1a-4bab-97c6-20091af71546",
                "domain-name--ebdde75e-723c-4790-91fd-8dddc113677e",
                "domain-name--0c4136c5-6d42-40c6-bc31-99a3f0cdc845",
                "domain-name--8dfd75b8-20c2-46ce-8345-e924e91e2bf4",
                "domain-name--1752c84c-78fb-48cd-b688-a1920cc6b9b5",
                "domain-name--36db19b9-6ae5-4f88-b84b-945a050f2698",
                "ipv4-addr--8836e09a-7ebf-4400-8443-d9e5ddace6db",
                "ipv4-addr--9c4d9685-30b5-4b86-9e47-e7bb54294846",
                "file--f9c4a0d3-0f52-44a7-aa16-a55a03a81276",
                "domain-name--2a2c7d0e-b09c-4dc5-8fc1-6f442f44c07a",
                "domain-name--3e93ea5f-8918-45aa-ad20-f83002a53332",
                "domain-name--1d7f16b8-8489-4d1e-b31f-27d4ffda57d4",
                "file--732d8ec8-b53c-4241-a66d-f623ed76fe8a",
                "threat-actor--af08d5c9-f507-5ed5-9986-7ffea3df195b"
            ],
            "external_references": [
                {
                    "source_name": "source",
                    "url": "https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/"
                }
            ]
        }
    ]
}