APT indicators as they appear upstream, attributed and dated tag:trilwu.github.io,2026:apttrail/activity 2026-08-08T03:26:30+00:00 APTtrailhttps://github.com/trilwu/apttrail tag:trilwu.github.io,2026:G0032/b-2026-08-07-4dc567 2026-08-07T00:00:00Z <p>10 ipv4 first seen upstream on 2026-08-07.</p><p>Source:</p><ul><li><a href="https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/">https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-08-07-a77f82 2026-08-07T00:00:00Z <p>8 domain first seen upstream on 2026-08-07.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0121/b-2026-08-07-b4263c 2026-08-07T00:00:00Z <p>5 domain first seen upstream on 2026-08-07.</p><p>Source:</p><ul><li><a href="https://x.com/joe4security/status/2085384961570349091">https://x.com/joe4security/status/2085384961570349091</a></li><li><a href="https://www.joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e-bbfd-a5b7188fa521/download?type=reports&report=html">https://www.joesandbox.com/joereverser/analysis/2e03ffcc-7c06-455e-bbfd-a5b7188fa521/download?type=reports&report=html</a></li><li><a href="https://www.virustotal.com/gui/file/3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2/detection">https://www.virustotal.com/gui/file/3b9432019a80a62fe6760a65f2677783bd60383b60206a5db7237a1b050647a2/detection</a></li><li><a href="https://www.virustotal.com/gui/file/6b85e9c7dd33416a096e377303d82ac49c8c3044f969ff72560409a3f1151cfb/detection">https://www.virustotal.com/gui/file/6b85e9c7dd33416a096e377303d82ac49c8c3044f969ff72560409a3f1151cfb/detection</a></li></ul> tag:trilwu.github.io,2026:G0121/b-2026-08-07-35d114 2026-08-07T00:00:00Z <p>3 domain first seen upstream on 2026-08-07.</p><p>Source:</p><ul><li><a href="https://x.com/volrant136/status/2085410874051981755">https://x.com/volrant136/status/2085410874051981755</a></li></ul> tag:trilwu.github.io,2026:UNC6691/b-2026-08-06-568685 2026-08-06T00:00:00Z <p>7,221 domain, 5 ipv4 first seen upstream on 2026-08-06.</p><p>Source:</p><ul><li><a href="https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/">https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-08-06-c3225f 2026-08-06T00:00:00Z <p>62 domain first seen upstream on 2026-08-06.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-08-06-a77f82 2026-08-06T00:00:00Z <p>15 domain first seen upstream on 2026-08-06.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-08-06-4dc567 2026-08-06T00:00:00Z <p>3 ipv4 first seen upstream on 2026-08-06.</p><p>Source:</p><ul><li><a href="https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/">https://www.microsoft.com/en-us/security/blog/2026/02/24/c2-developer-targeting-campaign/</a></li></ul> tag:trilwu.github.io,2026:UNC6691/b-2026-08-06-ddb617 2026-08-06T00:00:00Z <p>3 domain first seen upstream on 2026-08-06.</p><p>Source:</p><ul><li><a href="https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit">https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit</a></li><li><a href="https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking">https://iverify.io/blog/coruna-inside-the-nation-state-grade-ios-exploit-kit-we-ve-been-tracking</a></li><li><a href="https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/">https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/</a></li></ul> tag:trilwu.github.io,2026:G0100/b-2026-08-05-51f8f1 2026-08-05T00:00:00Z <p>14 domain first seen upstream on 2026-08-05.</p><p>Source:</p><ul><li><a href="https://twitter.com/felixaime/status/1601257303080308739">https://twitter.com/felixaime/status/1601257303080308739</a></li><li><a href="https://twitter.com/felixaime/status/1601257305294921728">https://twitter.com/felixaime/status/1601257305294921728</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-08-05-1f6549 2026-08-05T00:00:00Z <p>1 domain, 3 ipv4 first seen upstream on 2026-08-05.</p><p>Source:</p><ul><li><a href="https://x.com/ishivtripathi/status/2084907438243991883">https://x.com/ishivtripathi/status/2084907438243991883</a></li><li><a href="https://www.virustotal.com/gui/file/ab65cef60fc097c2a9fb03a7855c9c03dfe3ccc874080720f0e631c6ee2c3e51/detection">https://www.virustotal.com/gui/file/ab65cef60fc097c2a9fb03a7855c9c03dfe3ccc874080720f0e631c6ee2c3e51/detection</a></li><li><a href="https://www.virustotal.com/gui/file/225d7482772a26e4236d91cae51197ab1dfbdd42232157c3e169c19177a384e1/detection">https://www.virustotal.com/gui/file/225d7482772a26e4236d91cae51197ab1dfbdd42232157c3e169c19177a384e1/detection</a></li><li><a href="https://www.virustotal.com/gui/file/5c9bc15e2db6ca97ff325159d6c07fd381a39f9e55ef69499bbfde51bb064808/detection">https://www.virustotal.com/gui/file/5c9bc15e2db6ca97ff325159d6c07fd381a39f9e55ef69499bbfde51bb064808/detection</a></li></ul> tag:trilwu.github.io,2026:G0121/b-2026-08-05-ebbc34 2026-08-05T00:00:00Z <p>4 domain first seen upstream on 2026-08-05.</p><p>Source:</p><ul><li><a href="https://x.com/blackorbird/status/2084940847863509476">https://x.com/blackorbird/status/2084940847863509476</a></li><li><a href="https://mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg">https://mp.weixin.qq.com/s/PALBLusD4umh_52gy2wVAg</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-08-05-6d3876 2026-08-05T00:00:00Z <p>1 domain first seen upstream on 2026-08-05.</p><p>Source:</p><ul><li><a href="https://x.com/KseProso/status/2084984281785389166">https://x.com/KseProso/status/2084984281785389166</a></li></ul> tag:trilwu.github.io,2026:G0069/b-2026-08-04-769eb7 2026-08-04T00:00:00Z <p>1,932 domain first seen upstream on 2026-08-04.</p><p>Source:</p><ul><li><a href="https://www.security.com/threat-intelligence/iran-seedworm-electronics">https://www.security.com/threat-intelligence/iran-seedworm-electronics</a></li><li><a href="https://www.virustotal.com/gui/ip-address/192.124.216.133/relations">https://www.virustotal.com/gui/ip-address/192.124.216.133/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/217.71.204.197/relations">https://www.virustotal.com/gui/ip-address/217.71.204.197/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/57.129.117.19/relations">https://www.virustotal.com/gui/ip-address/57.129.117.19/relations</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-08-04-c3225f 2026-08-04T00:00:00Z <p>42 domain first seen upstream on 2026-08-04.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-08-04-a77f82 2026-08-04T00:00:00Z <p>5 domain first seen upstream on 2026-08-04.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:UNC6691/b-2026-08-04-568685 2026-08-04T00:00:00Z <p>1 domain first seen upstream on 2026-08-04.</p><p>Source:</p><ul><li><a href="https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/">https://www.validin.com/blog/aye_coruna_ios_exploit_kit_c2/</a></li></ul> tag:trilwu.github.io,2026:G0069/b-2026-08-03-769eb7 2026-08-03T00:00:00Z <p>1,400 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://www.security.com/threat-intelligence/iran-seedworm-electronics">https://www.security.com/threat-intelligence/iran-seedworm-electronics</a></li><li><a href="https://www.virustotal.com/gui/ip-address/192.124.216.133/relations">https://www.virustotal.com/gui/ip-address/192.124.216.133/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/217.71.204.197/relations">https://www.virustotal.com/gui/ip-address/217.71.204.197/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/57.129.117.19/relations">https://www.virustotal.com/gui/ip-address/57.129.117.19/relations</a></li></ul> tag:trilwu.github.io,2026:G0134/b-2026-08-03-29c924 2026-08-03T00:00:00Z <p>264 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/PrakkiSathwik/status/1979514409551819168">https://x.com/PrakkiSathwik/status/1979514409551819168</a></li></ul> tag:trilwu.github.io,2026:G0069/b-2026-08-03-7946d8 2026-08-03T00:00:00Z <p>122 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/phatomcandle/status/2079989870622298451">https://x.com/phatomcandle/status/2079989870622298451</a></li></ul> tag:trilwu.github.io,2026:G0134/b-2026-08-03-a3b405 2026-08-03T00:00:00Z <p>15 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/Malwarehunterr/status/2073465217888223424">https://x.com/Malwarehunterr/status/2073465217888223424</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-08-03-c3225f 2026-08-03T00:00:00Z <p>14 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:G0134/b-2026-08-03-287189 2026-08-03T00:00:00Z <p>13 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2066130507427983633">https://x.com/skocherhan/status/2066130507427983633</a></li></ul> tag:trilwu.github.io,2026:G0040/b-2026-08-03-cbd37b 2026-08-03T00:00:00Z <p>10 domain, 2 url_path first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/SinghSoodeep/status/2084220447487381592">https://x.com/SinghSoodeep/status/2084220447487381592</a></li><li><a href="https://www.virustotal.com/gui/file/d1ae51e18644263c9fdf618b285c978edb46507295faaf60062794011afb31b9/detection">https://www.virustotal.com/gui/file/d1ae51e18644263c9fdf618b285c978edb46507295faaf60062794011afb31b9/detection</a></li><li><a href="https://www.virustotal.com/gui/file/6d142127e10dc9bd88e804d0f71278540fa4278c85e6eac6bd6480151e9486a8/detection">https://www.virustotal.com/gui/file/6d142127e10dc9bd88e804d0f71278540fa4278c85e6eac6bd6480151e9486a8/detection</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-08-03-5e6768 2026-08-03T00:00:00Z <p>1 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/">https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/</a></li><li><a href="https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/">https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/</a></li><li><a href="https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection">https://www.virustotal.com/gui/file/d8de31bcaf5b9ebb99bef36244b0ab3c21367821947a789dff69c33d49aaffc9/detection</a></li></ul> tag:trilwu.github.io,2026:G0069/b-2026-08-03-42bf5b 2026-08-03T00:00:00Z <p>1 url_path first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://www.virustotal.com/gui/file/8ab83a870b4015ecba44502697d5c078466db2d6cc355c03f0d72f9cb2d57961/detection">https://www.virustotal.com/gui/file/8ab83a870b4015ecba44502697d5c078466db2d6cc355c03f0d72f9cb2d57961/detection</a></li><li><a href="https://www.virustotal.com/gui/file/addc18597f18cd87b2b3e0e2cab2b9a63ddad6eb44bbbfdf02233a3db1059709/detection">https://www.virustotal.com/gui/file/addc18597f18cd87b2b3e0e2cab2b9a63ddad6eb44bbbfdf02233a3db1059709/detection</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-08-03-a77f82 2026-08-03T00:00:00Z <p>1 domain first seen upstream on 2026-08-03.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-08-02-c3225f 2026-08-02T00:00:00Z <p>9 domain first seen upstream on 2026-08-02.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:PAPERWEREWOLF/b-2026-08-02-eeafbd 2026-08-02T00:00:00Z <p>9 domain first seen upstream on 2026-08-02.</p><p>Source:</p><ul><li><a href="https://x.com/phatomcandle/status/2083976136669974980">https://x.com/phatomcandle/status/2083976136669974980</a></li><li><a href="https://www.virustotal.com/gui/ip-address/130.49.213.54/relations">https://www.virustotal.com/gui/ip-address/130.49.213.54/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/213.165.61.50/relations">https://www.virustotal.com/gui/ip-address/213.165.61.50/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/77.110.112.165/relations">https://www.virustotal.com/gui/ip-address/77.110.112.165/relations</a></li></ul> tag:trilwu.github.io,2026:G0016/b-2026-08-02-68056f 2026-08-02T00:00:00Z <p>1 domain first seen upstream on 2026-08-02.</p><p>Source:</p><ul><li><a href="https://x.com/LloydLabs/status/2083594247547068883">https://x.com/LloydLabs/status/2083594247547068883</a></li><li><a href="https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/">https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/</a></li></ul> tag:trilwu.github.io,2026:PAPERWEREWOLF/b-2026-08-02-b23109 2026-08-02T00:00:00Z <p>1 domain first seen upstream on 2026-08-02.</p><p>Source:</p><ul><li><a href="https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/">https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/</a></li><li><a href="https://www.virustotal.com/gui/ip-address/193.233.18.135/relations">https://www.virustotal.com/gui/ip-address/193.233.18.135/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/213.165.61.226/relations">https://www.virustotal.com/gui/ip-address/213.165.61.226/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/78.153.149.182/relations">https://www.virustotal.com/gui/ip-address/78.153.149.182/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/87.251.66.114/relations">https://www.virustotal.com/gui/ip-address/87.251.66.114/relations</a></li><li><a href="https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection">https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection</a></li><li><a href="https://x.com/phatomcandle/status/2083976136669974980">https://x.com/phatomcandle/status/2083976136669974980</a></li><li><a href="https://www.virustotal.com/gui/ip-address/130.49.213.54/relations">https://www.virustotal.com/gui/ip-address/130.49.213.54/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/213.165.61.50/relations">https://www.virustotal.com/gui/ip-address/213.165.61.50/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/77.110.112.165/relations">https://www.virustotal.com/gui/ip-address/77.110.112.165/relations</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-08-01-c3225f 2026-08-01T00:00:00Z <p>70 domain first seen upstream on 2026-08-01.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:G0016/b-2026-08-01-68056f 2026-08-01T00:00:00Z <p>5 domain, 14 ipv4, 1 url_path first seen upstream on 2026-08-01.</p><p>Source:</p><ul><li><a href="https://x.com/LloydLabs/status/2083594247547068883">https://x.com/LloydLabs/status/2083594247547068883</a></li><li><a href="https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/">https://www.microsoft.com/en-us/security/blog/2026/07/31/captivecrunch-midnight-blizzard-targets-travelers-worldwide-for-malware-delivery-and-credential-theft/</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-08-01-a77f82 2026-08-01T00:00:00Z <p>12 domain first seen upstream on 2026-08-01.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0121/b-2026-08-01-f41b35 2026-08-01T00:00:00Z <p>1 domain first seen upstream on 2026-08-01.</p><p>Source:</p><ul><li><a href="https://x.com/phatomcandle/status/2077737009569808478">https://x.com/phatomcandle/status/2077737009569808478</a></li><li><a href="https://x.com/volrant136/status/2083246886262313189">https://x.com/volrant136/status/2083246886262313189</a></li><li><a href="https://www.virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5833e63ba5e06aeb5fafba093edf0f7e1b9/detection">https://www.virustotal.com/gui/file/1202845815bc416bdfd8be09f500b5833e63ba5e06aeb5fafba093edf0f7e1b9/detection</a></li></ul> tag:trilwu.github.io,2026:G0040/b-2026-07-31-5f0196 2026-07-31T00:00:00Z <p>1 domain first seen upstream on 2026-07-31.</p><p>Source:</p><ul><li><a href="https://app.validin.com/detail?type=hash&find=caa62d2795e1d665608e9cf51ef7d088#tab=host_pairs (# 2025-01-26)">https://app.validin.com/detail?type=hash&find=caa62d2795e1d665608e9cf51ef7d088#tab=host_pairs (# 2025-01-26)</a></li><li><a href="https://www.virustotal.com/gui/ip-address/206.188.197.82/relations">https://www.virustotal.com/gui/ip-address/206.188.197.82/relations</a></li><li><a href="https://www.virustotal.com/gui/ip-address/45.61.139.141/relations">https://www.virustotal.com/gui/ip-address/45.61.139.141/relations</a></li><li><a href="https://www.virustotal.com/gui/file/41fae8ffc58fab5e1405aa95baec295c3d64512b2fc59cd8abe3fbb0a03667f6/detection">https://www.virustotal.com/gui/file/41fae8ffc58fab5e1405aa95baec295c3d64512b2fc59cd8abe3fbb0a03667f6/detection</a></li><li><a href="https://www.virustotal.com/gui/file/e8dcdbbfaea83f0aa48fc74b7fb960de2935fcd4621ef7f4e5bb46ad2792418a/detection">https://www.virustotal.com/gui/file/e8dcdbbfaea83f0aa48fc74b7fb960de2935fcd4621ef7f4e5bb46ad2792418a/detection</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-07-30-c3225f 2026-07-30T00:00:00Z <p>38 domain first seen upstream on 2026-07-30.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-07-30-a77f82 2026-07-30T00:00:00Z <p>5 domain first seen upstream on 2026-07-30.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-07-29-c3225f 2026-07-29T00:00:00Z <p>96 domain first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:G0058/b-2026-07-29-ceefdc 2026-07-29T00:00:00Z <p>29 domain, 1 url_path first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://securelist.com/mirage-kitten-new-tools/120811/">https://securelist.com/mirage-kitten-new-tools/120811/</a></li></ul> tag:trilwu.github.io,2026:TRIANGULATION/b-2026-07-29-91ad19 2026-07-29T00:00:00Z <p>3 domain, 12 url_path first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://x.com/blackorbird/status/2082028695909449873">https://x.com/blackorbird/status/2082028695909449873</a></li><li><a href="https://www.virustotal.com/gui/ip-address/185.151.31.6/relations">https://www.virustotal.com/gui/ip-address/185.151.31.6/relations</a></li><li><a href="https://www.gendigital.com/blog/insights/research/chasing-an-angry-spark">https://www.gendigital.com/blog/insights/research/chasing-an-angry-spark</a></li><li><a href="https://medium.com/@billmarczak/an-angry-spark-or-a-triangle-in-disguise-ac32852a1be3">https://medium.com/@billmarczak/an-angry-spark-or-a-triangle-in-disguise-ac32852a1be3</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-07-29-aa7063 2026-07-29T00:00:00Z <p>5 domain, 6 ipv4, 2 url first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://x.com/tuckner/status/2065140621497561236">https://x.com/tuckner/status/2065140621497561236</a></li><li><a href="https://gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d">https://gist.github.com/danslo/1778c3bf30d65967db2d680727cbc89d</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-07-29-a77f82 2026-07-29T00:00:00Z <p>3 domain first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-07-29-d4271b 2026-07-29T00:00:00Z <p>2 domain first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://x.com/malwrhunterteam/status/2036158996554637591">https://x.com/malwrhunterteam/status/2036158996554637591</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-07-29-ec0122 2026-07-29T00:00:00Z <p>1 ipv4 first seen upstream on 2026-07-29.</p><p>Source:</p><ul><li><a href="https://asec.ahnlab.com/en/94552/">https://asec.ahnlab.com/en/94552/</a></li></ul> tag:trilwu.github.io,2026:G0094/b-2026-07-28-c3225f 2026-07-28T00:00:00Z <p>117 domain first seen upstream on 2026-07-28.</p><p>Source:</p><ul><li><a href="https://x.com/skocherhan/status/2047382182000312798">https://x.com/skocherhan/status/2047382182000312798</a></li><li><a href="https://x.com/skocherhan/status/2048153192563613921">https://x.com/skocherhan/status/2048153192563613921</a></li></ul> tag:trilwu.github.io,2026:UNC2465/b-2026-07-28-a77f82 2026-07-28T00:00:00Z <p>34 domain first seen upstream on 2026-07-28.</p><p>Source:</p><ul><li><a href="https://x.com/g0njxa/status/2010485906466394343">https://x.com/g0njxa/status/2010485906466394343</a></li><li><a href="https://x.com/g0njxa/status/2027082406847709524">https://x.com/g0njxa/status/2027082406847709524</a></li><li><a href="https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection">https://www.virustotal.com/gui/file/cbbe98e1b36eb68a7afe534c21055f9cc793c2a6a7ca63256d273020a096f7a7/detection</a></li><li><a href="https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection">https://www.virustotal.com/gui/file/30427b6732fea64c2cdc0b40c19695902f2bdea5f87dab16b4082bb3cf208557/detection</a></li></ul> tag:trilwu.github.io,2026:G0040/b-2026-07-28-b88dd7 2026-07-28T00:00:00Z <p>8 domain first seen upstream on 2026-07-28.</p><p>Source:</p><ul><li><a href="https://x.com/ThreatBookLabs/status/1974988141854609418">https://x.com/ThreatBookLabs/status/1974988141854609418</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-07-28-f9b2c7 2026-07-28T00:00:00Z <p>1 domain first seen upstream on 2026-07-28.</p><p>Source:</p><ul><li><a href="https://x.com/malwrhunterteam/status/2064325045938274373">https://x.com/malwrhunterteam/status/2064325045938274373</a></li><li><a href="https://x.com/malwrhunterteam/status/2069411902774472896">https://x.com/malwrhunterteam/status/2069411902774472896</a></li><li><a href="https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection">https://www.virustotal.com/gui/file/c7a24e1fc68b7233e1c93c02409e9429a1ea5cf0662eb4cd03364373df7d7044/detection</a></li><li><a href="https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection">https://www.virustotal.com/gui/file/9d7576046152695728ead43e9752a105ef2641ef6317ff8d47094b8f541835b2/detection</a></li><li><a href="https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection">https://www.virustotal.com/gui/file/70f732e98634c3f887d84ba8acb1ee7b62e4f865ea4cb1be1edf32c40c27ae51/detection</a></li><li><a href="https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection">https://www.virustotal.com/gui/file/51e1f3a97629e8db50ca1f9a0b68c019e74c07ce5209d5eefd4a2e3f4fe62869/detection</a></li><li><a href="https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection">https://www.virustotal.com/gui/file/322b2eb4e4d61ec6a746e3da421e8fd9c62ce4f919f03aed373f663de539b2ba/detection</a></li><li><a href="https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection">https://www.virustotal.com/gui/file/068505fab1dc1b784ddc845c9eeeba8e04da512383ecd55a7a3d076879656393/detection</a></li><li><a href="https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection">https://www.virustotal.com/gui/file/0988384971ae7a2213793eab632112599031694fba074516b615ca0367f2bf8d/detection</a></li><li><a href="https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection">https://www.virustotal.com/gui/file/3ad42864371905aa4618ab74dcd67b2ddb578b9e3ecaa998f9a54a59fd3fa50c/detection</a></li><li><a href="https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection">https://www.virustotal.com/gui/file/4524b20f1d3c3299c66058e9bcba6f7a18675b7a6eea52c593a08259220c37ae/detection</a></li><li><a href="https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection">https://www.virustotal.com/gui/file/cc92280557b399ec9271af08c5b6f576c8478a7e2660f8fe1b4e8df3d0d80904/detection</a></li></ul> tag:trilwu.github.io,2026:G0032/b-2026-07-28-f4665a 2026-07-28T00:00:00Z <p>1 ipv4 first seen upstream on 2026-07-28.</p><p>Source:</p><ul><li><a href="https://x.com/KirkDerpca/status/2065027462761787802">https://x.com/KirkDerpca/status/2065027462761787802</a></li><li><a href="https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm">https://panther.com/blog/tracking-an-ottercookie-infostealer-campaign-across-npm</a></li></ul>