{
  "aliases": [
    "ashenlepus",
    "ashenloader",
    "ashenorchestrator",
    "ashenstager",
    "ashtag"
  ],
  "attack_id": "G0090",
  "attack_name": "WIRTE",
  "attack_url": "https://attack.mitre.org/groups/G0090/",
  "counts": {
    "domain": 82,
    "ipv4": 6,
    "url": 1,
    "url_path": 1
  },
  "first_seen": {
    "domain": {
      "account.techupinfo.com": "2026-01-02",
      "allaccounting.ca": "2022-03-17",
      "api.healthylifefeed.com": "2026-01-02",
      "api.medicinefinders.com": "2026-01-02",
      "api.softmatictech.com": "2026-01-02",
      "api.systemsync.info": "2026-01-02",
      "api.technology-system.com": "2026-01-02",
      "api.widetechno.info": "2026-01-02",
      "apiv2.onlinefieldtech.com": "2026-01-02",
      "auth.onlinefieldtech.com": "2026-01-02",
      "bankjordan.com": "2024-11-14",
      "cdn.techpointinfo.com": "2026-01-02",
      "check.office365-update.com": "2026-01-02",
      "dentalaccord.com": "2024-11-14",
      "dentalmatrix.net": "2020-01-29",
      "doctoressolis.com": "2022-03-17",
      "download.share2file.pro": "2026-01-02",
      "easybackupcloud.com": "2024-11-14",
      "economymentor.com": "2024-11-14",
      "economystocking.com": "2024-11-14",
      "eg.foxlove.life": "2026-01-02",
      "egyptican.com": "2024-11-14",
      "egyptskytours.com": "2024-11-14",
      "egypttourism-online.com": "2024-11-14",
      "ellemedic.com": "2024-11-14",
      "est-clinic.com": "2022-03-17",
      "finance-analyst.com": "2024-11-14",
      "financecovers.com": "2024-11-14",
      "financeinfoguide.com": "2024-11-14",
      "firstohiobank.com": "2022-03-17",
      "forum.technoforts.com": "2026-01-02",
      "forum.techtg.com": "2026-01-02",
      "fox.foxlove.life": "2026-01-02",
      "foxlove.life": "2018-09-14",
      "healthcarb.com": "2024-11-14",
      "healthoptionstoday.com": "2024-11-14",
      "healthscratches.com": "2024-11-14",
      "healthylifefeed.com": "2026-01-02",
      "imagine-world.com": "2022-04-25",
      "jo.foxlove.life": "2026-01-02",
      "jordanrefugees.com": "2024-11-14",
      "jordansons.com": "2024-11-14",
      "king-pharmacy.com": "2024-11-14",
      "kneeexercises.net": "2022-03-17",
      "master-dental.com": "2024-11-14",
      "medicinefinders.com": "2026-01-02",
      "micorsoft.store": "2019-02-05",
      "microsoftliveforums.com": "2024-11-14",
      "microsoftteams365.com": "2024-11-14",
      "microsoftwindowshelp.com": "2024-11-14",
      "neweconomysolution.com": "2022-09-07",
      "niftybuysellchart.com": "2022-03-17",
      "nutrition-information.org": "2022-03-17",
      "office-update.services": "2018-09-14",
      "office365-update.co": "2019-02-05",
      "office365-update.com": "2019-04-21",
      "omegaeyehospital.com": "2020-03-03",
      "onlinefieldtech.com": "2026-01-02",
      "pocket-property.com": "2022-03-17",
      "printspoolerupdates.com": "2024-11-14",
      "qrdorks.com": "2024-11-14",
      "saudiarabianow.org": "2024-11-14",
      "saudiday.org": "2024-11-14",
      "share2file.pro": "2018-09-14",
      "softmatictech.com": "2026-01-02",
      "status.techupinfo.com": "2026-01-02",
      "stgeorgebankers.com": "2021-03-18",
      "sun-tourist.com": "2022-09-07",
      "suppertools.com": "2024-11-14",
      "support-api.financecovers.com": "2024-11-14",
      "systemsync.info": "2026-01-02",
      "technoforts.com": "2026-01-02",
      "techpointinfo.com": "2026-01-02",
      "techtg.com": "2026-01-02",
      "techupinfo.com": "2026-01-02",
      "thefinanceinvest.com": "2022-07-04",
      "theshortner.com": "2024-11-14",
      "trendingcharts.finance-analyst.com": "2024-11-14",
      "unitedfamilyhealth.net": "2021-03-17",
      "update.share2file.pro": "2026-01-02",
      "wellhealthtech.com": "2024-11-14",
      "widetechno.info": "2026-01-02"
    },
    "ipv4": {
      "104.24.108.64:2082": "2019-04-21",
      "104.24.109.64:2082": "2019-04-21",
      "104.28.1.134:2087": "2020-01-29",
      "172.86.75.211:80": "2020-01-29",
      "185.86.79.243:2082": "2019-04-21",
      "194.38.11.3:1790": "2026-01-02"
    },
    "url": {
      "http://20.43.53.72": "2022-07-04"
    },
    "url_path": {
      "/okceG": "2022-07-04"
    }
  },
  "first_seen_precision": {
    "domain": {
      "account.techupinfo.com": "at-or-before",
      "api.healthylifefeed.com": "at-or-before",
      "api.medicinefinders.com": "at-or-before",
      "api.softmatictech.com": "at-or-before",
      "api.systemsync.info": "at-or-before",
      "api.technology-system.com": "at-or-before",
      "api.widetechno.info": "at-or-before",
      "apiv2.onlinefieldtech.com": "at-or-before",
      "auth.onlinefieldtech.com": "at-or-before",
      "cdn.techpointinfo.com": "at-or-before",
      "check.office365-update.com": "at-or-before",
      "download.share2file.pro": "at-or-before",
      "eg.foxlove.life": "at-or-before",
      "forum.technoforts.com": "at-or-before",
      "forum.techtg.com": "at-or-before",
      "fox.foxlove.life": "at-or-before",
      "healthylifefeed.com": "at-or-before",
      "jo.foxlove.life": "at-or-before",
      "medicinefinders.com": "at-or-before",
      "onlinefieldtech.com": "at-or-before",
      "softmatictech.com": "at-or-before",
      "status.techupinfo.com": "at-or-before",
      "systemsync.info": "at-or-before",
      "technoforts.com": "at-or-before",
      "techpointinfo.com": "at-or-before",
      "techtg.com": "at-or-before",
      "techupinfo.com": "at-or-before",
      "update.share2file.pro": "at-or-before",
      "widetechno.info": "at-or-before"
    },
    "ipv4": {
      "194.38.11.3:1790": "at-or-before"
    },
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2018-09-14",
    "latest": "2026-01-02"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "account.techupinfo.com",
      "allaccounting.ca",
      "api.healthylifefeed.com",
      "api.medicinefinders.com",
      "api.softmatictech.com",
      "api.systemsync.info",
      "api.technology-system.com",
      "api.widetechno.info",
      "apiv2.onlinefieldtech.com",
      "auth.onlinefieldtech.com",
      "bankjordan.com",
      "cdn.techpointinfo.com",
      "check.office365-update.com",
      "dentalaccord.com",
      "dentalmatrix.net",
      "doctoressolis.com",
      "download.share2file.pro",
      "easybackupcloud.com",
      "economymentor.com",
      "economystocking.com",
      "eg.foxlove.life",
      "egyptican.com",
      "egyptskytours.com",
      "egypttourism-online.com",
      "ellemedic.com",
      "est-clinic.com",
      "finance-analyst.com",
      "financecovers.com",
      "financeinfoguide.com",
      "firstohiobank.com",
      "forum.technoforts.com",
      "forum.techtg.com",
      "fox.foxlove.life",
      "foxlove.life",
      "healthcarb.com",
      "healthoptionstoday.com",
      "healthscratches.com",
      "healthylifefeed.com",
      "imagine-world.com",
      "jo.foxlove.life",
      "jordanrefugees.com",
      "jordansons.com",
      "king-pharmacy.com",
      "kneeexercises.net",
      "master-dental.com",
      "medicinefinders.com",
      "micorsoft.store",
      "microsoftliveforums.com",
      "microsoftteams365.com",
      "microsoftwindowshelp.com",
      "neweconomysolution.com",
      "niftybuysellchart.com",
      "nutrition-information.org",
      "office-update.services",
      "office365-update.co",
      "office365-update.com",
      "omegaeyehospital.com",
      "onlinefieldtech.com",
      "pocket-property.com",
      "printspoolerupdates.com",
      "qrdorks.com",
      "saudiarabianow.org",
      "saudiday.org",
      "share2file.pro",
      "softmatictech.com",
      "status.techupinfo.com",
      "stgeorgebankers.com",
      "sun-tourist.com",
      "suppertools.com",
      "support-api.financecovers.com",
      "systemsync.info",
      "technoforts.com",
      "techpointinfo.com",
      "techtg.com",
      "techupinfo.com",
      "thefinanceinvest.com",
      "theshortner.com",
      "trendingcharts.finance-analyst.com",
      "unitedfamilyhealth.net",
      "update.share2file.pro",
      "wellhealthtech.com",
      "widetechno.info"
    ],
    "ipv4": [
      "104.24.108.64:2082",
      "104.24.109.64:2082",
      "104.28.1.134:2087",
      "172.86.75.211:80",
      "185.86.79.243:2082",
      "194.38.11.3:1790"
    ],
    "url": [
      "http://20.43.53.72"
    ],
    "url_path": [
      "/okceG"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "WIRTE"
  ],
  "references": [
    "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
    "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
    "https://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html",
    "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d",
    "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/",
    "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
    "https://twitter.com/James_inthe_box/status/1119932303088578561",
    "https://twitter.com/MoBustami/status/1119959411156488192",
    "https://twitter.com/SBousseaden/status/1222465015975948289",
    "https://twitter.com/SaudiDFIR/status/1119666633251930113",
    "https://twitter.com/h2jazi/status/1518629712364515329",
    "https://twitter.com/h2jazi/status/1543957383193444352",
    "https://twitter.com/h2jazi/status/1567247803184779266",
    "https://twitter.com/h2jazi/status/1567247805986574341",
    "https://twitter.com/malwrhunterteam/status/1233666708616941570",
    "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/",
    "https://www.securityartwork.es/2019/01/18/grupo-wirte-atacando-a-oriente-medio/",
    "https://www.securityartwork.es/2019/01/25/wirte-group-attacking-the-middle-east/",
    "https://www.virustotal.com/gui/file/086e49e431272b1ea8e3c1d7a9e297a8c50891db833bf180f2a5e9035f1bee8b/detection",
    "https://www.virustotal.com/gui/file/08a8ecc39817a81bb9cde3775ce7289d56e678e94b56b120e06eca171634a97d/detection",
    "https://www.virustotal.com/gui/file/467b59feba8ebaa7ef81b19ca69c133c07953affebeaf32f2d284b12533391be/detection",
    "https://www.virustotal.com/gui/file/58ff981332189a0a2e0b1152f36a5eb58402501fcf218339deab69a187edf823/detection",
    "https://www.virustotal.com/gui/file/9979ed5993fb6d678727e6dacb15d26c1b4f07f16404b62dc8b5e25a359d9aec/detection",
    "https://www.virustotal.com/gui/file/d767e2ba31b75714aeb1cc3995de9191a53bd184e213780987e51e315ec2e4c5/detection",
    "https://www.virustotal.com/gui/file/d9dc90fd23cd2ad5e5a1b9df65d36f5328e0bfec7c278b2b6010d9812012ec5a/detection",
    "https://www.virustotal.com/gui/file/e21362195463fe7c953afe07bea6a26ffead024c7f7394f51b683cbfe139b917/detection",
    "https://x.com/k3yp0d/status/1857000802067345730",
    "https://x.com/malwrhunterteam/status/1998743764630732932"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G1001"
    },
    {
      "evidence": [
        {
          "detail": "shares Rclone",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G0069"
    },
    {
      "evidence": [
        {
          "detail": "shares Rclone",
          "kind": "software",
          "weight": 0.333
        }
      ],
      "slug": "G1003"
    }
  ],
  "slug": "G0090",
  "timeline": [
    {
      "counts": {
        "domain": 23
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "account.techupinfo.com",
          "api.healthylifefeed.com",
          "api.medicinefinders.com",
          "api.softmatictech.com",
          "api.systemsync.info",
          "api.technology-system.com",
          "api.widetechno.info",
          "apiv2.onlinefieldtech.com",
          "auth.onlinefieldtech.com",
          "cdn.techpointinfo.com",
          "forum.technoforts.com",
          "forum.techtg.com",
          "healthylifefeed.com",
          "medicinefinders.com",
          "onlinefieldtech.com",
          "softmatictech.com",
          "status.techupinfo.com",
          "systemsync.info",
          "technoforts.com",
          "techpointinfo.com",
          "techtg.com",
          "techupinfo.com",
          "widetechno.info"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/",
        "https://www.virustotal.com/gui/file/9979ed5993fb6d678727e6dacb15d26c1b4f07f16404b62dc8b5e25a359d9aec/detection"
      ],
      "total": 23
    },
    {
      "counts": {
        "domain": 6,
        "ipv4": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "check.office365-update.com",
          "download.share2file.pro",
          "eg.foxlove.life",
          "fox.foxlove.life",
          "jo.foxlove.life",
          "update.share2file.pro"
        ],
        "ipv4": [
          "194.38.11.3:1790"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html",
        "https://twitter.com/SaudiDFIR/status/1119666633251930113",
        "https://twitter.com/James_inthe_box/status/1119932303088578561",
        "https://twitter.com/MoBustami/status/1119959411156488192",
        "https://x.com/malwrhunterteam/status/1998743764630732932",
        "https://www.virustotal.com/gui/file/d9dc90fd23cd2ad5e5a1b9df65d36f5328e0bfec7c278b2b6010d9812012ec5a/detection"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 31
      },
      "first_seen": "2024-11-14",
      "indicators": {
        "domain": [
          "bankjordan.com",
          "dentalaccord.com",
          "easybackupcloud.com",
          "economymentor.com",
          "economystocking.com",
          "egyptican.com",
          "egyptskytours.com",
          "egypttourism-online.com",
          "ellemedic.com",
          "finance-analyst.com",
          "financecovers.com",
          "financeinfoguide.com",
          "healthcarb.com",
          "healthoptionstoday.com",
          "healthscratches.com",
          "jordanrefugees.com",
          "jordansons.com",
          "king-pharmacy.com",
          "master-dental.com",
          "microsoftliveforums.com",
          "microsoftteams365.com",
          "microsoftwindowshelp.com",
          "printspoolerupdates.com",
          "qrdorks.com",
          "saudiarabianow.org",
          "saudiday.org",
          "suppertools.com",
          "support-api.financecovers.com",
          "theshortner.com",
          "trendingcharts.finance-analyst.com",
          "wellhealthtech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/k3yp0d/status/1857000802067345730",
        "https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"
      ],
      "total": 31
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-09-07",
      "indicators": {
        "domain": [
          "neweconomysolution.com",
          "sun-tourist.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1567247803184779266",
        "https://twitter.com/h2jazi/status/1567247805986574341",
        "https://www.virustotal.com/gui/file/e21362195463fe7c953afe07bea6a26ffead024c7f7394f51b683cbfe139b917/detection",
        "https://www.virustotal.com/gui/file/08a8ecc39817a81bb9cde3775ce7289d56e678e94b56b120e06eca171634a97d/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1,
        "url": 1,
        "url_path": 1
      },
      "first_seen": "2022-07-04",
      "indicators": {
        "domain": [
          "thefinanceinvest.com"
        ],
        "url": [
          "http://20.43.53.72"
        ],
        "url_path": [
          "/okceG"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1543957383193444352",
        "https://www.virustotal.com/gui/file/58ff981332189a0a2e0b1152f36a5eb58402501fcf218339deab69a187edf823/detection",
        "https://www.virustotal.com/gui/file/467b59feba8ebaa7ef81b19ca69c133c07953affebeaf32f2d284b12533391be/detection",
        "https://www.virustotal.com/gui/file/086e49e431272b1ea8e3c1d7a9e297a8c50891db833bf180f2a5e9035f1bee8b/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-04-25",
      "indicators": {
        "domain": [
          "imagine-world.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1518629712364515329",
        "https://www.virustotal.com/gui/file/d767e2ba31b75714aeb1cc3995de9191a53bd184e213780987e51e315ec2e4c5/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 8
      },
      "first_seen": "2022-03-17",
      "indicators": {
        "domain": [
          "allaccounting.ca",
          "doctoressolis.com",
          "est-clinic.com",
          "firstohiobank.com",
          "kneeexercises.net",
          "niftybuysellchart.com",
          "nutrition-information.org",
          "pocket-property.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1233666708616941570",
        "https://twitter.com/SBousseaden/status/1222465015975948289",
        "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
        "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
        "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
        "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d"
      ],
      "total": 8
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-03-18",
      "indicators": {
        "domain": [
          "stgeorgebankers.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1233666708616941570",
        "https://twitter.com/SBousseaden/status/1222465015975948289",
        "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
        "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
        "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
        "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-03-17",
      "indicators": {
        "domain": [
          "unitedfamilyhealth.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1233666708616941570",
        "https://twitter.com/SBousseaden/status/1222465015975948289",
        "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
        "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
        "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
        "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-03-03",
      "indicators": {
        "domain": [
          "omegaeyehospital.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1233666708616941570",
        "https://twitter.com/SBousseaden/status/1222465015975948289",
        "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
        "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
        "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
        "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 2
      },
      "first_seen": "2020-01-29",
      "indicators": {
        "domain": [
          "dentalmatrix.net"
        ],
        "ipv4": [
          "104.28.1.134:2087",
          "172.86.75.211:80"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/malwrhunterteam/status/1233666708616941570",
        "https://twitter.com/SBousseaden/status/1222465015975948289",
        "https://app.any.run/tasks/b63ec8f5-70a6-4379-97e9-acbe3ce5ecde/",
        "https://app.any.run/tasks/4c404a75-4caf-430b-a901-c18bc8fb0824/",
        "https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044/",
        "https://otx.alienvault.com/pulse/61a4fb7c9b88f16b103c151d"
      ],
      "total": 3
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2019-04-21",
      "indicators": {
        "ipv4": [
          "104.24.108.64:2082",
          "104.24.109.64:2082",
          "185.86.79.243:2082"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.securityartwork.es/2019/01/18/grupo-wirte-atacando-a-oriente-medio/",
        "https://www.securityartwork.es/2019/01/25/wirte-group-attacking-the-middle-east/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-04-21",
      "indicators": {
        "domain": [
          "office365-update.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html",
        "https://twitter.com/SaudiDFIR/status/1119666633251930113",
        "https://twitter.com/James_inthe_box/status/1119932303088578561",
        "https://twitter.com/MoBustami/status/1119959411156488192",
        "https://x.com/malwrhunterteam/status/1998743764630732932",
        "https://www.virustotal.com/gui/file/d9dc90fd23cd2ad5e5a1b9df65d36f5328e0bfec7c278b2b6010d9812012ec5a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2019-02-05",
      "indicators": {
        "domain": [
          "micorsoft.store",
          "office365-update.co"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.securityartwork.es/2019/01/18/grupo-wirte-atacando-a-oriente-medio/",
        "https://www.securityartwork.es/2019/01/25/wirte-group-attacking-the-middle-east/"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2018-09-14",
      "indicators": {
        "domain": [
          "foxlove.life",
          "office-update.services",
          "share2file.pro"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2018/02/targeted-attacks-in-middle-east.html",
        "https://twitter.com/SaudiDFIR/status/1119666633251930113",
        "https://twitter.com/James_inthe_box/status/1119932303088578561",
        "https://twitter.com/MoBustami/status/1119959411156488192",
        "https://x.com/malwrhunterteam/status/1998743764630732932",
        "https://www.virustotal.com/gui/file/d9dc90fd23cd2ad5e5a1b9df65d36f5328e0bfec7c278b2b6010d9812012ec5a/detection"
      ],
      "total": 3
    }
  ]
}