{
  "aliases": [
    "baitswitch",
    "calisto",
    "coldcopy",
    "darksword",
    "lostkeys",
    "mayberobot",
    "simplefix",
    "ta446",
    "unc3707",
    "yesrobot"
  ],
  "attack_id": "G1033",
  "attack_name": "Star Blizzard",
  "attack_url": "https://attack.mitre.org/groups/G1033/",
  "counts": {
    "domain": 469,
    "ipv4": 3,
    "url": 3
  },
  "first_seen": {
    "domain": {
      "access-confirmation.com": "2022-12-07",
      "account.officesecure.online": "2026-01-02",
      "accounts-ukr.com": "2024-11-01",
      "accounts.hypertexttech.com": "2022-12-06",
      "accounts.kv-ukr.net": "2024-07-25",
      "accounts.ukr-mails.net": "2024-07-25",
      "accounts.ukr-reset.email": "2024-07-25",
      "accsua.com": "2024-11-01",
      "accsukr.com": "2024-11-01",
      "advath.officesecure.online": "2026-01-02",
      "alightcruellane.net": "2024-11-01",
      "allow-access.com": "2022-12-07",
      "ankaramuhaseben.com": "2024-10-07",
      "antibots-service.com": "2022-12-07",
      "apicomcloud.com": "2022-12-07",
      "app-sharcpoint.com": "2024-08-11",
      "app-sharcpointe.com": "2024-08-12",
      "app-sharcpolnt.com": "2024-08-11",
      "app-sharcpolnte.com": "2024-08-11",
      "applicationformsubmit.me": "2026-01-02",
      "appsharcpointe.com": "2024-08-11",
      "appsharcpointes.com": "2024-08-11",
      "appssharcpointe.com": "2024-08-11",
      "as-mvd.ru": "2022-12-07",
      "attach-docs.com": "2022-12-07",
      "attach-update.com": "2022-12-07",
      "auth.officesecure.online": "2026-01-02",
      "authpoint.usa.officesecure.online": "2026-01-02",
      "betmgm-support.com": "2026-01-02",
      "betus-us.info": "2026-01-02",
      "bigdatabroadway.com": "2024-10-07",
      "bittechllc.net": "2023-08-10",
      "blintepeeste.org": "2026-01-02",
      "blueskynetwork-drive.com": "2022-12-07",
      "blueskynetwork-shared.com": "2022-12-07",
      "botguard-checker.com": "2022-12-07",
      "botguard-web.com": "2022-12-07",
      "cache-dns-forwarding.com": "2022-08-16",
      "cache-dns-preview.com": "2022-08-16",
      "cache-dns.com": "2022-05-04",
      "cache-docs.com": "2022-06-23",
      "cache-pdf.com": "2022-06-20",
      "cache-pdf.online": "2022-07-20",
      "cache-services.live": "2022-08-16",
      "captchanom.top": "2026-01-02",
      "centeritdefcity.com": "2023-08-10",
      "challenge-identifier.com": "2022-12-07",
      "challenge-share.com": "2022-12-07",
      "changepassword-ukr.net": "2024-07-25",
      "checker-bot.com": "2022-12-07",
      "checkscreenit.com": "2023-08-10",
      "cija-docs.com": "2022-12-07",
      "cija-drive.com": "2022-12-07",
      "cityessentials.net": "2024-10-07",
      "client-serviceauth0.com": "2024-08-12",
      "cloud-docs.com": "2022-06-23",
      "cloud-drive.live": "2022-08-16",
      "cloud-mail.online": "2022-08-16",
      "cloud-safety.online": "2022-12-07",
      "cloud-sharcpoint.com": "2024-08-12",
      "cloud-sharcpointe.com": "2024-08-11",
      "cloud-sharcpolnte.com": "2024-08-12",
      "cloud-sharepolnt.com": "2024-08-11",
      "cloud-storage.live": "2022-08-16",
      "cloud-us.online": "2022-12-07",
      "cloudcpanelhost.com": "2023-08-10",
      "clouddefsystems.com": "2023-08-10",
      "cloudinfodata.com": "2024-10-07",
      "cloudithub.com": "2024-10-07",
      "cloudmediaportal.com": "2026-01-02",
      "cloudrootstorage.com": "2023-08-10",
      "cloudsharepolnte.com": "2024-08-11",
      "commandentrance.com": "2023-08-10",
      "computertechdirectsystems.com": "2023-08-10",
      "computingtechstudio.com": "2023-08-10",
      "configuregatewayglobal.com": "2023-08-10",
      "controlgatestorage.com": "2023-08-10",
      "controlsstoragedirect.com": "2023-08-10",
      "controlstoragesolutions.com": "2023-08-10",
      "cryptdatagate.com": "2023-08-10",
      "cryptotechdirect.com": "2023-08-10",
      "cryptothistech.com": "2023-08-10",
      "data-ukr.com": "2024-11-01",
      "datagatellc.com": "2023-08-10",
      "datagatewayglobal.com": "2023-08-10",
      "datastoragecrypto.com": "2023-08-10",
      "datawebhub.com": "2024-10-07",
      "default-dns.online": "2022-12-07",
      "definform.com": "2023-08-10",
      "desgnspiration.net": "2024-10-07",
      "deskactivitygm.com": "2023-08-10",
      "directdocumentgate.com": "2023-08-10",
      "directdocumentgateway.com": "2023-08-10",
      "directexpressgateway.com": "2023-08-10",
      "directstoragegate.com": "2023-08-10",
      "disk-previewer.com": "2022-12-07",
      "dns-cache.online": "2022-12-07",
      "dns-challenge.com": "2022-12-07",
      "dns-cookie.com": "2022-12-07",
      "dns-mvd.ru": "2022-12-07",
      "doc-sharcpoint.com": "2024-08-12",
      "doc-sharcpointe.com": "2024-08-12",
      "doc-sharepointe.com": "2024-08-11",
      "docs-cache.com": "2022-06-23",
      "docs-cache.online": "2022-12-07",
      "docs-collector.com": "2022-12-07",
      "docs-drive.online": "2022-06-23",
      "docs-forwarding.online": "2022-08-16",
      "docs-info.com": "2022-06-23",
      "docs-info.online": "2022-08-16",
      "docs-sharcpoint.com": "2024-08-11",
      "docs-sharcpointe.com": "2024-08-12",
      "docs-sharcpolnt.com": "2024-08-12",
      "docs-sharcpolnte.com": "2024-08-11",
      "docs-shared.com": "2022-05-04",
      "docs-shared.online": "2022-08-16",
      "docs-sharepolnt.com": "2024-08-11",
      "docs-storage-ltd.com": "2022-12-07",
      "docs-view.online": "2022-08-16",
      "docs-viewer.online": "2022-12-07",
      "docs-web.online": "2022-12-07",
      "docsinfogate.com": "2023-08-10",
      "document-forwarding.com": "2022-08-16",
      "document-guard.com": "2022-12-07",
      "document-online.live": "2022-08-16",
      "document-preview.com": "2022-08-16",
      "document-sender.com": "2022-12-07",
      "document-share.live": "2022-08-16",
      "document-view.live": "2022-08-16",
      "documentdirectllc.com": "2023-08-10",
      "documentdirectto.com": "2023-08-10",
      "documents-cloud.com": "2022-06-23",
      "documents-cloud.online": "2022-06-23",
      "documents-forwarding.com": "2022-05-04",
      "documents-online.live": "2022-08-16",
      "documents-pdf.online": "2022-06-23",
      "documents-preview.com": "2022-05-04",
      "documents-view.live": "2022-08-16",
      "documentsec.com": "2026-01-02",
      "documentsec.online": "2026-01-02",
      "dotfoods.officesecure.online": "2026-01-02",
      "drive-control.com": "2022-12-07",
      "drive-defender.com": "2022-12-07",
      "drive-docs.com": "2022-06-23",
      "drive-global-ordnance.com": "2022-12-07",
      "drive-globalordnance.com": "2022-12-07",
      "drive-information.com": "2022-12-07",
      "drive-previewer.com": "2022-12-07",
      "drive-share.live": "2022-03-30",
      "drive-us.online": "2022-12-07",
      "dtgruelle-drive.com": "2022-12-07",
      "dtgruelle-us.com": "2022-12-07",
      "e-fluxxsolutions.com": "2024-10-07",
      "editablezoom.org": "2024-10-07",
      "egenre.net": "2024-08-14",
      "eichenfass.org": "2024-10-07",
      "eilatocare.com": "2024-08-14",
      "encompass-drive.com": "2022-12-07",
      "encompass-shared.com": "2022-12-07",
      "entheogenicmd.com": "2024-10-07",
      "entrywaycenter.com": "2023-08-10",
      "esestacey.net": "2024-08-14",
      "extractordraw.com": "2024-10-07",
      "file-milgov.systems": "2022-06-23",
      "filter-bot.com": "2022-12-07",
      "fogelmtab.online": "2026-01-02",
      "galetscryptodata.com": "2024-10-07",
      "gateblurbrepository.com": "2023-08-10",
      "gatecryptospace.com": "2023-08-10",
      "gateinfosecure.com": "2023-08-10",
      "gatestoragetech.com": "2023-08-10",
      "gatewaydocsint.com": "2023-08-10",
      "gatewayitsol.com": "2023-08-10",
      "gatewayrecord.com": "2023-08-10",
      "gawecryptoinfosolutions.com": "2023-08-10",
      "getfigmacreator.com": "2024-10-07",
      "getinfostarter.com": "2023-08-10",
      "global-ordnance-drive.com": "2022-12-07",
      "goo-ink.online": "2022-12-06",
      "goo-link.online": "2022-08-16",
      "gothicshop.org": "2024-10-07",
      "goweb-protect.com": "2022-12-07",
      "goweb-service.com": "2022-12-07",
      "guard-checker.com": "2022-12-07",
      "guardittech.com": "2024-10-07",
      "hazerscotomacarted.org": "2026-01-02",
      "hd-centre-drive.com": "2022-12-07",
      "hd-docs-share.com": "2022-12-07",
      "helmetkup.com": "2024-10-07",
      "hypertexttech.com": "2022-12-06",
      "hypertextteches.com": "2022-06-23",
      "hypertextttech.com": "2022-12-07",
      "iceageblokegra.org": "2026-01-02",
      "id.officesecure.online": "2026-01-02",
      "ideaspire.net": "2024-08-14",
      "imgrich.com": "2024-10-07",
      "incappcloud.com": "2023-08-10",
      "infocryptogate.com": "2023-08-10",
      "infogatestorage.com": "2023-08-10",
      "informationcoindata.com": "2023-08-10",
      "informationswitchsystems.com": "2023-08-10",
      "infostorageroute.com": "2023-08-10",
      "inrealconnect.com": "2024-10-07",
      "inspectguarantee.org": "2026-01-02",
      "instantpointzero.com": "2024-10-07",
      "intelligencerepository.com": "2023-08-10",
      "intelligentautomationalley.com": "2024-10-07",
      "investfix.org": "2024-10-07",
      "itgatestorage.com": "2023-08-10",
      "ithostprotocol.com": "2024-08-14",
      "itinfogate.com": "2023-08-10",
      "justapple.net": "2024-10-07",
      "keeperdocumentllc.com": "2024-10-07",
      "keeperitlabel.com": "2024-10-07",
      "keepitlabgroup.com": "2023-08-10",
      "kinoafisha.ua.ukrrr.com": "2024-11-01",
      "kv-ukr.net": "2024-07-25",
      "land-of-service.com": "2022-12-07",
      "liquidacionesjudiciales.com": "2024-10-07",
      "live-identifier.com": "2022-12-07",
      "lmhtvn.github.io": "2026-03-28",
      "localukre.com": "2024-11-01",
      "login.officesecure.online": "2026-01-02",
      "loyaltyfirst.org": "2024-10-07",
      "mail-docs.online": "2022-08-16",
      "mail-ukr-net.systems": "2024-11-01",
      "mail.officesecure.online": "2026-01-02",
      "managercodepro.com": "2023-08-10",
      "manageukr.net": "2024-11-01",
      "matalangit.org": "2024-08-14",
      "mayquarkesthetic.com": "2024-10-07",
      "mediasrangylavi.org": "2026-01-02",
      "meshgoin.com": "2023-08-10",
      "mettezera.com": "2024-10-07",
      "mobilizationcenter.com.ua": "2026-01-02",
      "msfed.officesecure.online": "2026-01-02",
      "mtgcgroup.org": "2024-10-07",
      "murodjonovs.com": "2024-10-07",
      "mutualrescuebook.org": "2024-10-07",
      "mvd-cloud.ru": "2022-12-07",
      "mvd-redir.ru": "2022-12-07",
      "mxhvn.github.io": "2026-03-28",
      "mybookie-us.live": "2026-01-02",
      "mygeiger.org": "2024-10-07",
      "myitappnext.com": "2023-08-10",
      "myittechnext.com": "2023-08-10",
      "ned-granting-opportunities.com": "2026-01-02",
      "ned-granting-opportunitis.org": "2026-01-02",
      "network-storage-ltd.com": "2022-12-07",
      "networkgoin.com": "2023-08-10",
      "njala.dev": "2026-01-02",
      "nonviolent-conflict-service.com": "2022-12-07",
      "nonviolent-conflict-storage.com": "2022-12-07",
      "o.officesecure.online": "2026-01-02",
      "office-protection.online": "2022-06-23",
      "office.officesecure.online": "2026-01-02",
      "office365-online.live": "2022-08-16",
      "officeonline365.live": "2022-08-16",
      "officesecure.online": "2026-01-02",
      "ommahat.net": "2024-10-07",
      "oneinformationcrypto.com": "2023-08-10",
      "online-document.live": "2022-08-16",
      "online-storage.live": "2022-08-16",
      "online-word.com": "2022-12-07",
      "online365-office.com": "2022-08-16",
      "onlinecloud365.live": "2022-08-16",
      "onlineviewerdocument.com": "2026-01-02",
      "onlwshop.eu": "2026-01-02",
      "onstorageline.com": "2026-01-02",
      "osomtoys.com": "2024-10-07",
      "outlook.officesecure.online": "2026-01-02",
      "owaorganizespace.com": "2024-10-07",
      "oxwoocat.org": "2026-01-02",
      "particlesolid.org": "2024-10-07",
      "pdf-cache.com": "2022-08-16",
      "pdf-cache.online": "2022-07-20",
      "pdf-cloud.online": "2022-06-23",
      "pdf-docs.online": "2022-06-23",
      "pdf-forwarding.online": "2022-07-20",
      "pdf-shared.online": "2022-06-23",
      "pdfdirectglobal.com": "2023-08-10",
      "pdfsecxcloudroute.com": "2023-08-10",
      "po.vatangate.com": "2023-08-10",
      "postrequestin.com": "2024-10-07",
      "preentootmist.org": "2026-01-02",
      "preview-docs.com": "2022-12-07",
      "preview-docs.online": "2022-12-07",
      "preview-document.tech": "2024-10-07",
      "pro-mybookie.com": "2026-01-02",
      "prodefendme.com": "2023-08-10",
      "proffsolution.com": "2024-10-07",
      "prokeeperit.com": "2023-08-10",
      "protect-link.online": "2022-03-30",
      "protectedshields-storage.com": "2022-12-07",
      "protectedviews.com": "2023-08-10",
      "protection-checklinks.xyz": "2022-08-16",
      "protection-link.online": "2022-05-04",
      "protection-office.live": "2022-03-30",
      "protection-web-app.com": "2022-12-07",
      "protectionmail.online": "2022-06-23",
      "protectionoffice.tech": "2024-10-07",
      "protectordocumentcenter.com": "2023-08-10",
      "proton-docs.com": "2022-06-23",
      "proton-pdf.online": "2022-08-16",
      "proton-reader.com": "2022-08-16",
      "proton-view.online": "2022-06-23",
      "proton-viewer.com": "2022-03-30",
      "proxycrioisolation.com": "2022-12-07",
      "pureafro.com": "2024-10-07",
      "qr-logukr.com": "2024-11-01",
      "quantumnyx.org": "2024-10-07",
      "react.officesecure.online": "2026-01-02",
      "realeasyconfiguregateway.com": "2023-08-10",
      "realitsolutionprimary.com": "2023-08-10",
      "redir-document.com": "2022-12-07",
      "relogin-dashboard.online": "2022-08-16",
      "response-collector.com": "2022-12-07",
      "response-filter.com": "2022-12-07",
      "response-mvd.ru": "2022-12-07",
      "response-redir.com": "2022-12-07",
      "riseupbit.com": "2024-10-07",
      "safe-connection.online": "2022-08-16",
      "safe-proof.com": "2022-12-07",
      "safelinks-protect.live": "2022-08-16",
      "safetydocsgateway.com": "2023-08-10",
      "sangrail-ltd.com": "2022-12-07",
      "sangrail-share.com": "2022-12-07",
      "scallopsflippant.com": "2024-11-01",
      "sci.officesecure.online": "2026-01-02",
      "sdij.org": "2026-03-28",
      "secure.officesecure.online": "2026-01-02",
      "secureauth-login.com": "2024-08-11",
      "secureclientauth0.com": "2024-08-12",
      "secureglobaltele.com": "2023-08-10",
      "secureoffice.live": "2022-08-16",
      "selector-drafts.online": "2022-12-07",
      "serverguarditweb.com": "2023-08-10",
      "serviceauth0.com": "2024-08-11",
      "setupprofi.com": "2024-10-07",
      "seukr.net": "2024-11-01",
      "sgmods.net": "2024-10-07",
      "sharcpoint-app.com": "2024-08-11",
      "sharcpoint-docs.com": "2024-08-11",
      "sharcpoint-web.com": "2024-08-11",
      "sharcpointapp.com": "2024-08-11",
      "sharcpointe-cloud.com": "2024-08-11",
      "sharcpointe-doc.com": "2024-08-11",
      "sharcpointeapp.com": "2024-08-12",
      "sharcpointecloud.com": "2024-08-11",
      "sharcpointedoc.com": "2024-08-11",
      "sharcpointedocs.com": "2024-08-12",
      "sharcpointedocsapp.com": "2024-08-11",
      "sharcpointedocuments.com": "2024-08-11",
      "sharcpolnte-docs.com": "2024-08-11",
      "sharcpolnte-web.com": "2024-08-11",
      "share-drive-ua.com": "2022-12-07",
      "sharepointbeagle.com": "2024-08-11",
      "sharepointdesign.com": "2024-08-11",
      "sharepointe-cloud.com": "2024-08-11",
      "sharepointe-docs.com": "2024-08-11",
      "sharepointeapp.com": "2024-08-12",
      "sharepolnte-app.com": "2024-08-12",
      "sharepolnte-docs.com": "2024-08-11",
      "sharepolnte-web.com": "2024-08-11",
      "shielditlabel.com": "2023-08-10",
      "shortinfoonline.com": "2023-08-10",
      "siidj.xyz": "2026-03-28",
      "skeletcheck.com": "2024-10-07",
      "skycithereforeit.com": "2023-08-10",
      "skyinformdata.com": "2024-10-07",
      "smusxath.officesecure.online": "2026-01-02",
      "soaringeagle-drive.com": "2022-12-07",
      "solutionsseccloud.com": "2023-08-10",
      "sourcedoorway.com": "2023-08-10",
      "sourcedoorways.com": "2023-08-10",
      "southprovesolutions.com": "2026-01-02",
      "sp.authpoint.usa.officesecure.online": "2026-01-02",
      "sso.officesecure.online": "2026-01-02",
      "stateinfospace.com": "2023-08-10",
      "stayhome-services.fr": "2026-01-02",
      "storage-service.online": "2022-07-20",
      "storagecryptogate.com": "2023-08-10",
      "storagecryptoweb.com": "2023-08-10",
      "storageinfogate.com": "2023-08-10",
      "storageinformationsolutions.com": "2024-10-07",
      "storagekeeperinfopro.com": "2023-08-10",
      "storagekeeperinfotech.com": "2023-08-10",
      "storagerootconnect.com": "2023-08-10",
      "storagetruncservices.com": "2023-08-10",
      "storagewarden.com": "2023-08-10",
      "suppdatacent.com": "2023-08-10",
      "support-ukr.com": "2024-11-01",
      "swarmsdopwis.org": "2026-01-02",
      "system-healthadv.com": "2026-01-02",
      "system-sharcpoint.com": "2024-08-12",
      "system-sharcpointe.com": "2024-08-12",
      "tarifjane.com": "2024-10-07",
      "threatcenterofreaserch.com": "2022-12-07",
      "threatcenterofresearch.com": "2022-12-07",
      "togochecklist.com": "2024-08-14",
      "transfer-dns.com": "2022-12-07",
      "transfer-record.com": "2022-12-07",
      "translatesplit.com": "2024-10-07",
      "truncstorage.com": "2023-08-10",
      "uaccsnet.com": "2024-07-25",
      "ualogaccs.com": "2024-07-25",
      "uasettings.com": "2024-07-25",
      "uasetukr.com": "2024-07-25",
      "uasystdoc.com": "2024-07-25",
      "uasystnet.com": "2024-07-25",
      "ukainua.com": "2024-07-25",
      "ukenlog.com": "2024-07-25",
      "uknetlogin.com": "2024-07-25",
      "ukr-edit.com": "2024-11-01",
      "ukr-hub.com": "2024-11-01",
      "ukr-mail.com": "2024-11-01",
      "ukr-mails.net": "2024-07-25",
      "ukr-net.systems": "2024-11-01",
      "ukr-passc.net": "2024-11-01",
      "ukr-reset.email": "2024-07-25",
      "ukr-setting.com": "2024-09-25",
      "ukr-site.com": "2024-11-01",
      "ukraine-story.com": "2024-11-01",
      "ukrlocalsystems.net": "2024-11-01",
      "ukrmailpost.net": "2024-11-01",
      "ukrnetset.com": "2024-08-20",
      "ukrrbox.com": "2024-11-01",
      "ukrrr.com": "2024-11-01",
      "ukrsets.com": "2024-07-25",
      "ukrsett.com": "2024-07-25",
      "ukrstnet.com": "2024-07-25",
      "ulgroup.officesecure.online": "2026-01-02",
      "umo-drive.com": "2022-12-07",
      "umopl-drive.com": "2022-12-07",
      "umopl.com": "2022-12-07",
      "unetset.com": "2024-07-25",
      "usa.officesecure.online": "2026-01-02",
      "uukkrr.net": "2024-11-01",
      "vatangate.com": "2023-08-10",
      "verifukr.com": "2024-11-01",
      "viewerdoconline.com": "2026-01-02",
      "vn3hg.officesecure.online": "2026-01-02",
      "vocabpaper.com": "2024-08-14",
      "vod.sdij.org": "2026-03-28",
      "voltcloudpine.com": "2024-10-07",
      "web-sharcpoint.com": "2024-08-11",
      "web-sharcpolnt.com": "2024-08-11",
      "web-sharepolnt.com": "2024-08-11",
      "webfigmadesignershop.com": "2024-10-07",
      "webgateway.ru": "2023-08-10",
      "webgatewayenter.com": "2023-08-10",
      "webinterstellar.com": "2023-08-10",
      "webitresourse.com": "2024-10-07",
      "webmail.officesecure.online": "2026-01-02",
      "webresources.live": "2022-05-04",
      "webview-service.com": "2022-12-07",
      "word-yand.live": "2022-08-16",
      "ww12.officesecure.online": "2026-01-02",
      "xacshop.com": "2024-10-07",
      "xe-ukr.net": "2024-11-01",
      "xfiles-uk.net": "2024-11-01",
      "xh-ukr.net": "2024-11-01",
      "xsltweemat.org": "2024-08-14",
      "y-ml.co": "2022-08-16",
      "yamaru.org": "2024-10-07",
      "yandx-online.cloud": "2022-08-16",
      "yourdirectinfospace.com": "2023-08-10",
      "yourspaceprotector.com": "2023-08-10",
      "ywnjb.officesecure.online": "2026-01-02"
    },
    "ipv4": {
      "45.133.216.15:3000": "2024-01-18",
      "89.19.211.240:3000": "2024-03-14",
      "95.164.17.94:3000": "2024-03-14"
    },
    "url": {
      "http://165.227.148.68": "2026-01-02",
      "http://82.221.130.78": "2024-08-20",
      "http://82.221.139.200": "2024-07-25"
    }
  },
  "first_seen_precision": {
    "domain": {
      "account.officesecure.online": "at-or-before",
      "advath.officesecure.online": "at-or-before",
      "applicationformsubmit.me": "at-or-before",
      "auth.officesecure.online": "at-or-before",
      "authpoint.usa.officesecure.online": "at-or-before",
      "betmgm-support.com": "at-or-before",
      "betus-us.info": "at-or-before",
      "blintepeeste.org": "at-or-before",
      "captchanom.top": "at-or-before",
      "cloudmediaportal.com": "at-or-before",
      "documentsec.com": "at-or-before",
      "documentsec.online": "at-or-before",
      "dotfoods.officesecure.online": "at-or-before",
      "fogelmtab.online": "at-or-before",
      "hazerscotomacarted.org": "at-or-before",
      "iceageblokegra.org": "at-or-before",
      "id.officesecure.online": "at-or-before",
      "inspectguarantee.org": "at-or-before",
      "login.officesecure.online": "at-or-before",
      "mail.officesecure.online": "at-or-before",
      "mediasrangylavi.org": "at-or-before",
      "mobilizationcenter.com.ua": "at-or-before",
      "msfed.officesecure.online": "at-or-before",
      "mybookie-us.live": "at-or-before",
      "ned-granting-opportunities.com": "at-or-before",
      "ned-granting-opportunitis.org": "at-or-before",
      "njala.dev": "at-or-before",
      "o.officesecure.online": "at-or-before",
      "office.officesecure.online": "at-or-before",
      "officesecure.online": "at-or-before",
      "onlineviewerdocument.com": "at-or-before",
      "onlwshop.eu": "at-or-before",
      "onstorageline.com": "at-or-before",
      "outlook.officesecure.online": "at-or-before",
      "oxwoocat.org": "at-or-before",
      "preentootmist.org": "at-or-before",
      "pro-mybookie.com": "at-or-before",
      "react.officesecure.online": "at-or-before",
      "sci.officesecure.online": "at-or-before",
      "secure.officesecure.online": "at-or-before",
      "smusxath.officesecure.online": "at-or-before",
      "southprovesolutions.com": "at-or-before",
      "sp.authpoint.usa.officesecure.online": "at-or-before",
      "sso.officesecure.online": "at-or-before",
      "stayhome-services.fr": "at-or-before",
      "swarmsdopwis.org": "at-or-before",
      "system-healthadv.com": "at-or-before",
      "ulgroup.officesecure.online": "at-or-before",
      "usa.officesecure.online": "at-or-before",
      "viewerdoconline.com": "at-or-before",
      "vn3hg.officesecure.online": "at-or-before",
      "webmail.officesecure.online": "at-or-before",
      "ww12.officesecure.online": "at-or-before",
      "ywnjb.officesecure.online": "at-or-before"
    },
    "ipv4": {},
    "url": {
      "http://165.227.148.68": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2022-03-30",
    "latest": "2026-03-28"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "access-confirmation.com",
      "account.officesecure.online",
      "accounts-ukr.com",
      "accounts.hypertexttech.com",
      "accounts.kv-ukr.net",
      "accounts.ukr-mails.net",
      "accounts.ukr-reset.email",
      "accsua.com",
      "accsukr.com",
      "advath.officesecure.online",
      "alightcruellane.net",
      "allow-access.com",
      "ankaramuhaseben.com",
      "antibots-service.com",
      "apicomcloud.com",
      "app-sharcpoint.com",
      "app-sharcpointe.com",
      "app-sharcpolnt.com",
      "app-sharcpolnte.com",
      "applicationformsubmit.me",
      "appsharcpointe.com",
      "appsharcpointes.com",
      "appssharcpointe.com",
      "as-mvd.ru",
      "attach-docs.com",
      "attach-update.com",
      "auth.officesecure.online",
      "authpoint.usa.officesecure.online",
      "betmgm-support.com",
      "betus-us.info",
      "bigdatabroadway.com",
      "bittechllc.net",
      "blintepeeste.org",
      "blueskynetwork-drive.com",
      "blueskynetwork-shared.com",
      "botguard-checker.com",
      "botguard-web.com",
      "cache-dns-forwarding.com",
      "cache-dns-preview.com",
      "cache-dns.com",
      "cache-docs.com",
      "cache-pdf.com",
      "cache-pdf.online",
      "cache-services.live",
      "captchanom.top",
      "centeritdefcity.com",
      "challenge-identifier.com",
      "challenge-share.com",
      "changepassword-ukr.net",
      "checker-bot.com",
      "checkscreenit.com",
      "cija-docs.com",
      "cija-drive.com",
      "cityessentials.net",
      "client-serviceauth0.com",
      "cloud-docs.com",
      "cloud-drive.live",
      "cloud-mail.online",
      "cloud-safety.online",
      "cloud-sharcpoint.com",
      "cloud-sharcpointe.com",
      "cloud-sharcpolnte.com",
      "cloud-sharepolnt.com",
      "cloud-storage.live",
      "cloud-us.online",
      "cloudcpanelhost.com",
      "clouddefsystems.com",
      "cloudinfodata.com",
      "cloudithub.com",
      "cloudmediaportal.com",
      "cloudrootstorage.com",
      "cloudsharepolnte.com",
      "commandentrance.com",
      "computertechdirectsystems.com",
      "computingtechstudio.com",
      "configuregatewayglobal.com",
      "controlgatestorage.com",
      "controlsstoragedirect.com",
      "controlstoragesolutions.com",
      "cryptdatagate.com",
      "cryptotechdirect.com",
      "cryptothistech.com",
      "data-ukr.com",
      "datagatellc.com",
      "datagatewayglobal.com",
      "datastoragecrypto.com",
      "datawebhub.com",
      "default-dns.online",
      "definform.com",
      "desgnspiration.net",
      "deskactivitygm.com",
      "directdocumentgate.com",
      "directdocumentgateway.com",
      "directexpressgateway.com",
      "directstoragegate.com",
      "disk-previewer.com",
      "dns-cache.online",
      "dns-challenge.com",
      "dns-cookie.com",
      "dns-mvd.ru",
      "doc-sharcpoint.com",
      "doc-sharcpointe.com",
      "doc-sharepointe.com",
      "docs-cache.com",
      "docs-cache.online",
      "docs-collector.com",
      "docs-drive.online",
      "docs-forwarding.online",
      "docs-info.com",
      "docs-info.online",
      "docs-sharcpoint.com",
      "docs-sharcpointe.com",
      "docs-sharcpolnt.com",
      "docs-sharcpolnte.com",
      "docs-shared.com",
      "docs-shared.online",
      "docs-sharepolnt.com",
      "docs-storage-ltd.com",
      "docs-view.online",
      "docs-viewer.online",
      "docs-web.online",
      "docsinfogate.com",
      "document-forwarding.com",
      "document-guard.com",
      "document-online.live",
      "document-preview.com",
      "document-sender.com",
      "document-share.live",
      "document-view.live",
      "documentdirectllc.com",
      "documentdirectto.com",
      "documents-cloud.com",
      "documents-cloud.online",
      "documents-forwarding.com",
      "documents-online.live",
      "documents-pdf.online",
      "documents-preview.com",
      "documents-view.live",
      "documentsec.com",
      "documentsec.online",
      "dotfoods.officesecure.online",
      "drive-control.com",
      "drive-defender.com",
      "drive-docs.com",
      "drive-global-ordnance.com",
      "drive-globalordnance.com",
      "drive-information.com",
      "drive-previewer.com",
      "drive-share.live",
      "drive-us.online",
      "dtgruelle-drive.com",
      "dtgruelle-us.com",
      "e-fluxxsolutions.com",
      "editablezoom.org",
      "egenre.net",
      "eichenfass.org",
      "eilatocare.com",
      "encompass-drive.com",
      "encompass-shared.com",
      "entheogenicmd.com",
      "entrywaycenter.com",
      "esestacey.net",
      "extractordraw.com",
      "file-milgov.systems",
      "filter-bot.com",
      "fogelmtab.online",
      "galetscryptodata.com",
      "gateblurbrepository.com",
      "gatecryptospace.com",
      "gateinfosecure.com",
      "gatestoragetech.com",
      "gatewaydocsint.com",
      "gatewayitsol.com",
      "gatewayrecord.com",
      "gawecryptoinfosolutions.com",
      "getfigmacreator.com",
      "getinfostarter.com",
      "global-ordnance-drive.com",
      "goo-ink.online",
      "goo-link.online",
      "gothicshop.org",
      "goweb-protect.com",
      "goweb-service.com",
      "guard-checker.com",
      "guardittech.com",
      "hazerscotomacarted.org",
      "hd-centre-drive.com",
      "hd-docs-share.com",
      "helmetkup.com",
      "hypertexttech.com",
      "hypertextteches.com",
      "hypertextttech.com",
      "iceageblokegra.org",
      "id.officesecure.online",
      "ideaspire.net",
      "imgrich.com",
      "incappcloud.com",
      "infocryptogate.com",
      "infogatestorage.com",
      "informationcoindata.com",
      "informationswitchsystems.com",
      "infostorageroute.com",
      "inrealconnect.com",
      "inspectguarantee.org",
      "instantpointzero.com",
      "intelligencerepository.com",
      "intelligentautomationalley.com",
      "investfix.org",
      "itgatestorage.com",
      "ithostprotocol.com",
      "itinfogate.com",
      "justapple.net",
      "keeperdocumentllc.com",
      "keeperitlabel.com",
      "keepitlabgroup.com",
      "kinoafisha.ua.ukrrr.com",
      "kv-ukr.net",
      "land-of-service.com",
      "liquidacionesjudiciales.com",
      "live-identifier.com",
      "lmhtvn.github.io",
      "localukre.com",
      "login.officesecure.online",
      "loyaltyfirst.org",
      "mail-docs.online",
      "mail-ukr-net.systems",
      "mail.officesecure.online",
      "managercodepro.com",
      "manageukr.net",
      "matalangit.org",
      "mayquarkesthetic.com",
      "mediasrangylavi.org",
      "meshgoin.com",
      "mettezera.com",
      "mobilizationcenter.com.ua",
      "msfed.officesecure.online",
      "mtgcgroup.org",
      "murodjonovs.com",
      "mutualrescuebook.org",
      "mvd-cloud.ru",
      "mvd-redir.ru",
      "mxhvn.github.io",
      "mybookie-us.live",
      "mygeiger.org",
      "myitappnext.com",
      "myittechnext.com",
      "ned-granting-opportunities.com",
      "ned-granting-opportunitis.org",
      "network-storage-ltd.com",
      "networkgoin.com",
      "njala.dev",
      "nonviolent-conflict-service.com",
      "nonviolent-conflict-storage.com",
      "o.officesecure.online",
      "office-protection.online",
      "office.officesecure.online",
      "office365-online.live",
      "officeonline365.live",
      "officesecure.online",
      "ommahat.net",
      "oneinformationcrypto.com",
      "online-document.live",
      "online-storage.live",
      "online-word.com",
      "online365-office.com",
      "onlinecloud365.live",
      "onlineviewerdocument.com",
      "onlwshop.eu",
      "onstorageline.com",
      "osomtoys.com",
      "outlook.officesecure.online",
      "owaorganizespace.com",
      "oxwoocat.org",
      "particlesolid.org",
      "pdf-cache.com",
      "pdf-cache.online",
      "pdf-cloud.online",
      "pdf-docs.online",
      "pdf-forwarding.online",
      "pdf-shared.online",
      "pdfdirectglobal.com",
      "pdfsecxcloudroute.com",
      "po.vatangate.com",
      "postrequestin.com",
      "preentootmist.org",
      "preview-docs.com",
      "preview-docs.online",
      "preview-document.tech",
      "pro-mybookie.com",
      "prodefendme.com",
      "proffsolution.com",
      "prokeeperit.com",
      "protect-link.online",
      "protectedshields-storage.com",
      "protectedviews.com",
      "protection-checklinks.xyz",
      "protection-link.online",
      "protection-office.live",
      "protection-web-app.com",
      "protectionmail.online",
      "protectionoffice.tech",
      "protectordocumentcenter.com",
      "proton-docs.com",
      "proton-pdf.online",
      "proton-reader.com",
      "proton-view.online",
      "proton-viewer.com",
      "proxycrioisolation.com",
      "pureafro.com",
      "qr-logukr.com",
      "quantumnyx.org",
      "react.officesecure.online",
      "realeasyconfiguregateway.com",
      "realitsolutionprimary.com",
      "redir-document.com",
      "relogin-dashboard.online",
      "response-collector.com",
      "response-filter.com",
      "response-mvd.ru",
      "response-redir.com",
      "riseupbit.com",
      "safe-connection.online",
      "safe-proof.com",
      "safelinks-protect.live",
      "safetydocsgateway.com",
      "sangrail-ltd.com",
      "sangrail-share.com",
      "scallopsflippant.com",
      "sci.officesecure.online",
      "sdij.org",
      "secure.officesecure.online",
      "secureauth-login.com",
      "secureclientauth0.com",
      "secureglobaltele.com",
      "secureoffice.live",
      "selector-drafts.online",
      "serverguarditweb.com",
      "serviceauth0.com",
      "setupprofi.com",
      "seukr.net",
      "sgmods.net",
      "sharcpoint-app.com",
      "sharcpoint-docs.com",
      "sharcpoint-web.com",
      "sharcpointapp.com",
      "sharcpointe-cloud.com",
      "sharcpointe-doc.com",
      "sharcpointeapp.com",
      "sharcpointecloud.com",
      "sharcpointedoc.com",
      "sharcpointedocs.com",
      "sharcpointedocsapp.com",
      "sharcpointedocuments.com",
      "sharcpolnte-docs.com",
      "sharcpolnte-web.com",
      "share-drive-ua.com",
      "sharepointbeagle.com",
      "sharepointdesign.com",
      "sharepointe-cloud.com",
      "sharepointe-docs.com",
      "sharepointeapp.com",
      "sharepolnte-app.com",
      "sharepolnte-docs.com",
      "sharepolnte-web.com",
      "shielditlabel.com",
      "shortinfoonline.com",
      "siidj.xyz",
      "skeletcheck.com",
      "skycithereforeit.com",
      "skyinformdata.com",
      "smusxath.officesecure.online",
      "soaringeagle-drive.com",
      "solutionsseccloud.com",
      "sourcedoorway.com",
      "sourcedoorways.com",
      "southprovesolutions.com",
      "sp.authpoint.usa.officesecure.online",
      "sso.officesecure.online",
      "stateinfospace.com",
      "stayhome-services.fr",
      "storage-service.online",
      "storagecryptogate.com",
      "storagecryptoweb.com",
      "storageinfogate.com",
      "storageinformationsolutions.com",
      "storagekeeperinfopro.com",
      "storagekeeperinfotech.com",
      "storagerootconnect.com",
      "storagetruncservices.com",
      "storagewarden.com",
      "suppdatacent.com",
      "support-ukr.com",
      "swarmsdopwis.org",
      "system-healthadv.com",
      "system-sharcpoint.com",
      "system-sharcpointe.com",
      "tarifjane.com",
      "threatcenterofreaserch.com",
      "threatcenterofresearch.com",
      "togochecklist.com",
      "transfer-dns.com",
      "transfer-record.com",
      "translatesplit.com",
      "truncstorage.com",
      "uaccsnet.com",
      "ualogaccs.com",
      "uasettings.com",
      "uasetukr.com",
      "uasystdoc.com",
      "uasystnet.com",
      "ukainua.com",
      "ukenlog.com",
      "uknetlogin.com",
      "ukr-edit.com",
      "ukr-hub.com",
      "ukr-mail.com",
      "ukr-mails.net",
      "ukr-net.systems",
      "ukr-passc.net",
      "ukr-reset.email",
      "ukr-setting.com",
      "ukr-site.com",
      "ukraine-story.com",
      "ukrlocalsystems.net",
      "ukrmailpost.net",
      "ukrnetset.com",
      "ukrrbox.com",
      "ukrrr.com",
      "ukrsets.com",
      "ukrsett.com",
      "ukrstnet.com",
      "ulgroup.officesecure.online",
      "umo-drive.com",
      "umopl-drive.com",
      "umopl.com",
      "unetset.com",
      "usa.officesecure.online",
      "uukkrr.net",
      "vatangate.com",
      "verifukr.com",
      "viewerdoconline.com",
      "vn3hg.officesecure.online",
      "vocabpaper.com",
      "vod.sdij.org",
      "voltcloudpine.com",
      "web-sharcpoint.com",
      "web-sharcpolnt.com",
      "web-sharepolnt.com",
      "webfigmadesignershop.com",
      "webgateway.ru",
      "webgatewayenter.com",
      "webinterstellar.com",
      "webitresourse.com",
      "webmail.officesecure.online",
      "webresources.live",
      "webview-service.com",
      "word-yand.live",
      "ww12.officesecure.online",
      "xacshop.com",
      "xe-ukr.net",
      "xfiles-uk.net",
      "xh-ukr.net",
      "xsltweemat.org",
      "y-ml.co",
      "yamaru.org",
      "yandx-online.cloud",
      "yourdirectinfospace.com",
      "yourspaceprotector.com",
      "ywnjb.officesecure.online"
    ],
    "ipv4": [
      "45.133.216.15:3000",
      "89.19.211.240:3000",
      "95.164.17.94:3000"
    ],
    "url": [
      "http://165.227.148.68",
      "http://82.221.130.78",
      "http://82.221.139.200"
    ]
  },
  "last_modified": "2026-03-28T10:17:05+00:00",
  "maltrail_groups": [
    "COLDRIVER"
  ],
  "references": [
    "https://app.validin.com/detail?find=82.221.139.160&type=ip4&ref_id=850ab70d5c4#tab=resolutions",
    "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/ (# SPICA backdoor)",
    "https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/",
    "https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign/",
    "https://blog.sekoia.io/calisto-show-interests-into-entities-involved-in-ukraine-war-support/",
    "https://blog.strikeready.com/blog/russia-nexus-actor-targets-ukraine/",
    "https://cert.gov.ua/article/6280183 (# UAC-0102)",
    "https://citizenlab.ca/2024/08/sophisticated-phishing-targets-russias-perceived-enemies-around-the-globe/",
    "https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos/",
    "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-09-v10390/852",
    "https://medium.com/@fofabot/practical-fofa-asset-discovery-coldriver-bdb971f2413b",
    "https://otx.alienvault.com/pulse/6272996039678903e0b73dd5",
    "https://otx.alienvault.com/pulse/6390ecc150d6fda9ab97c604",
    "https://strikeready.com/blog/finding-the-unknown-unknowns-part-2/",
    "https://twitter.com/h2jazi/status/1538940189015429122",
    "https://twitter.com/r0ny_123/status/1549751626004500481",
    "https://urlscan.io/result/019d28bf-2dff-7003-adcb-4762f044e142",
    "https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/",
    "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html",
    "https://www.virustotal.com/gui/file/2f1f4b077b6fc40d8f0c995e80657448478a08acdf0e33ee2b73602bda62270c/detection",
    "https://www.virustotal.com/gui/file/37c52481711631a5c73a6341bd8bea302ad57f02199db7624b580058547fb5a9/detection",
    "https://www.virustotal.com/gui/file/38963b61113b7b88e3fce30539e63b4745f8d91f8e2577b6597a09648b105733/detection",
    "https://www.virustotal.com/gui/file/4c7accba35edd646584bb5a40ab78f963de45e5fc816e62022cd7ab1b01dae9c/detection",
    "https://www.virustotal.com/gui/file/52eb2b3df1e5e2a07ba4562b79eeb67679ac6f7f90190e72d3e6adcf5186401d/detection",
    "https://www.virustotal.com/gui/file/6b85d707c23d68f9518e757cc97adb20adc8accb33d0d68faf1d8d56d7840816/detection",
    "https://www.virustotal.com/gui/file/731ca51ac983f24f10409ae67eae65de81f661df2960bf309a412bca500185a7/detection",
    "https://www.virustotal.com/gui/file/7b95747eeea196c1485d089fa47a06bacb07d06399603d3a4fa153c21ce0a9ba/detection",
    "https://www.virustotal.com/gui/file/853f21ba9a8a362a9bafc98204eb70b8c23ba845359e694984711ec1485d0c2f/detection",
    "https://www.virustotal.com/gui/file/9e49db0eb920e130c0393a87c96434b9f0257025584cf546f623c1cb0b074333/detection",
    "https://www.virustotal.com/gui/file/bce2a7165ceead4e3601e311c72743e0059ec2cd734ce7acf5cc9f7d8795ba0f/detection",
    "https://www.virustotal.com/gui/file/d7520e4f1c55ed1dcbdeba5c6e681e1d269d9b5a690636bf18bcdc5b294f3f8a/detection",
    "https://www.virustotal.com/gui/file/db0c45bb0861ae458d90c09a1e7108f553a147514c3e6a4721eec9a9af639870/detection",
    "https://www.virustotal.com/gui/file/e159886a173f021b345ad152ad84beed3ac39b6a7455805c255f38d7b4c9434c/detection",
    "https://www.virustotal.com/gui/ip-address/147.45.124.240/relations",
    "https://www.virustotal.com/gui/ip-address/165.227.148.68/relations",
    "https://www.virustotal.com/gui/ip-address/20.36.28.23/relations",
    "https://www.virustotal.com/gui/ip-address/82.221.139.200/relations",
    "https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix",
    "https://x.com/JCyberSec_/status/2037789860455420316",
    "https://x.com/JCyberSec_/status/2037789874137297214",
    "https://x.com/StrikeReadyLabs/status/1825638114955510014",
    "https://x.com/StrikeReadyLabs/status/1839049108071526585",
    "https://x.com/alex_lanstein/status/1816306001781367143",
    "https://x.com/knight0x07/status/1921085672661651817"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 reports cite both",
          "kind": "reporting",
          "weight": 2.0
        }
      ],
      "slug": "UNC1151"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "G0010"
    },
    {
      "evidence": [
        {
          "detail": "1 report cite both",
          "kind": "reporting",
          "weight": 1.0
        }
      ],
      "slug": "COLDWASTREL"
    }
  ],
  "slug": "G1033",
  "timeline": [
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2026-03-28",
      "indicators": {
        "domain": [
          "sdij.org",
          "siidj.xyz",
          "vod.sdij.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/JCyberSec_/status/2037789860455420316",
        "https://urlscan.io/result/019d28bf-2dff-7003-adcb-4762f044e142"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2026-03-28",
      "indicators": {
        "domain": [
          "lmhtvn.github.io",
          "mxhvn.github.io"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/JCyberSec_/status/2037789874137297214"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 41
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "account.officesecure.online",
          "advath.officesecure.online",
          "auth.officesecure.online",
          "authpoint.usa.officesecure.online",
          "betmgm-support.com",
          "betus-us.info",
          "documentsec.online",
          "dotfoods.officesecure.online",
          "fogelmtab.online",
          "iceageblokegra.org",
          "id.officesecure.online",
          "inspectguarantee.org",
          "login.officesecure.online",
          "mail.officesecure.online",
          "msfed.officesecure.online",
          "mybookie-us.live",
          "ned-granting-opportunities.com",
          "ned-granting-opportunitis.org",
          "o.officesecure.online",
          "office.officesecure.online",
          "officesecure.online",
          "onlineviewerdocument.com",
          "onlwshop.eu",
          "outlook.officesecure.online",
          "oxwoocat.org",
          "pro-mybookie.com",
          "react.officesecure.online",
          "sci.officesecure.online",
          "secure.officesecure.online",
          "smusxath.officesecure.online",
          "sp.authpoint.usa.officesecure.online",
          "sso.officesecure.online",
          "stayhome-services.fr",
          "swarmsdopwis.org",
          "system-healthadv.com",
          "ulgroup.officesecure.online",
          "usa.officesecure.online",
          "vn3hg.officesecure.online",
          "webmail.officesecure.online",
          "ww12.officesecure.online",
          "ywnjb.officesecure.online"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://cloud.google.com/blog/topics/threat-intelligence/new-malware-russia-coldriver",
        "https://www.virustotal.com/gui/file/d7520e4f1c55ed1dcbdeba5c6e681e1d269d9b5a690636bf18bcdc5b294f3f8a/detection",
        "https://www.virustotal.com/gui/file/52eb2b3df1e5e2a07ba4562b79eeb67679ac6f7f90190e72d3e6adcf5186401d/detection",
        "https://www.virustotal.com/gui/file/bce2a7165ceead4e3601e311c72743e0059ec2cd734ce7acf5cc9f7d8795ba0f/detection",
        "https://www.virustotal.com/gui/file/731ca51ac983f24f10409ae67eae65de81f661df2960bf309a412bca500185a7/detection"
      ],
      "total": 41
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "applicationformsubmit.me",
          "blintepeeste.org",
          "captchanom.top",
          "documentsec.com",
          "hazerscotomacarted.org",
          "mediasrangylavi.org",
          "onstorageline.com",
          "preentootmist.org",
          "southprovesolutions.com",
          "viewerdoconline.com"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 2,
        "url": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "cloudmediaportal.com",
          "njala.dev"
        ],
        "url": [
          "http://165.227.148.68"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos/",
        "https://www.virustotal.com/gui/ip-address/165.227.148.68/relations",
        "https://www.virustotal.com/gui/file/4c7accba35edd646584bb5a40ab78f963de45e5fc816e62022cd7ab1b01dae9c/detection",
        "https://www.virustotal.com/gui/file/6b85d707c23d68f9518e757cc97adb20adc8accb33d0d68faf1d8d56d7840816/detection",
        "https://www.virustotal.com/gui/file/db0c45bb0861ae458d90c09a1e7108f553a147514c3e6a4721eec9a9af639870/detection"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "mobilizationcenter.com.ua"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://x.com/knight0x07/status/1921085672661651817"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 29
      },
      "first_seen": "2024-11-01",
      "indicators": {
        "domain": [
          "accounts-ukr.com",
          "accsua.com",
          "accsukr.com",
          "alightcruellane.net",
          "data-ukr.com",
          "kinoafisha.ua.ukrrr.com",
          "localukre.com",
          "mail-ukr-net.systems",
          "manageukr.net",
          "qr-logukr.com",
          "scallopsflippant.com",
          "seukr.net",
          "support-ukr.com",
          "ukr-edit.com",
          "ukr-hub.com",
          "ukr-mail.com",
          "ukr-net.systems",
          "ukr-passc.net",
          "ukr-site.com",
          "ukraine-story.com",
          "ukrlocalsystems.net",
          "ukrmailpost.net",
          "ukrrbox.com",
          "ukrrr.com",
          "uukkrr.net",
          "verifukr.com",
          "xe-ukr.net",
          "xfiles-uk.net",
          "xh-ukr.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1839049108071526585",
        "https://strikeready.com/blog/finding-the-unknown-unknowns-part-2/",
        "https://app.validin.com/detail?find=82.221.139.160&type=ip4&ref_id=850ab70d5c4#tab=resolutions"
      ],
      "total": 29
    },
    {
      "counts": {
        "domain": 56
      },
      "first_seen": "2024-10-07",
      "indicators": {
        "domain": [
          "ankaramuhaseben.com",
          "bigdatabroadway.com",
          "cityessentials.net",
          "cloudinfodata.com",
          "cloudithub.com",
          "datawebhub.com",
          "desgnspiration.net",
          "e-fluxxsolutions.com",
          "editablezoom.org",
          "eichenfass.org",
          "entheogenicmd.com",
          "extractordraw.com",
          "galetscryptodata.com",
          "getfigmacreator.com",
          "gothicshop.org",
          "guardittech.com",
          "helmetkup.com",
          "imgrich.com",
          "inrealconnect.com",
          "instantpointzero.com",
          "intelligentautomationalley.com",
          "investfix.org",
          "justapple.net",
          "keeperdocumentllc.com",
          "keeperitlabel.com",
          "liquidacionesjudiciales.com",
          "loyaltyfirst.org",
          "mayquarkesthetic.com",
          "mettezera.com",
          "mtgcgroup.org",
          "murodjonovs.com",
          "mutualrescuebook.org",
          "mygeiger.org",
          "ommahat.net",
          "osomtoys.com",
          "owaorganizespace.com",
          "particlesolid.org",
          "postrequestin.com",
          "preview-document.tech",
          "proffsolution.com",
          "protectionoffice.tech",
          "pureafro.com",
          "quantumnyx.org",
          "riseupbit.com",
          "setupprofi.com",
          "sgmods.net",
          "skeletcheck.com",
          "skyinformdata.com",
          "storageinformationsolutions.com",
          "tarifjane.com",
          "translatesplit.com",
          "voltcloudpine.com",
          "webfigmadesignershop.com",
          "webitresourse.com",
          "xacshop.com",
          "yamaru.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/20.36.28.23/relations"
      ],
      "total": 56
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2024-09-25",
      "indicators": {
        "domain": [
          "ukr-setting.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1839049108071526585",
        "https://strikeready.com/blog/finding-the-unknown-unknowns-part-2/",
        "https://app.validin.com/detail?find=82.221.139.160&type=ip4&ref_id=850ab70d5c4#tab=resolutions"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2024-08-20",
      "indicators": {
        "domain": [
          "ukrnetset.com"
        ],
        "url": [
          "http://82.221.130.78"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/StrikeReadyLabs/status/1825638114955510014"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2024-08-14",
      "indicators": {
        "domain": [
          "egenre.net",
          "eilatocare.com",
          "esestacey.net",
          "ideaspire.net",
          "ithostprotocol.com",
          "matalangit.org",
          "togochecklist.com",
          "vocabpaper.com",
          "xsltweemat.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2024/08/sophisticated-phishing-targets-russias-perceived-enemies-around-the-globe/"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 15
      },
      "first_seen": "2024-08-12",
      "indicators": {
        "domain": [
          "app-sharcpointe.com",
          "client-serviceauth0.com",
          "cloud-sharcpoint.com",
          "cloud-sharcpolnte.com",
          "doc-sharcpoint.com",
          "doc-sharcpointe.com",
          "docs-sharcpointe.com",
          "docs-sharcpolnt.com",
          "secureclientauth0.com",
          "sharcpointeapp.com",
          "sharcpointedocs.com",
          "sharepointeapp.com",
          "sharepolnte-app.com",
          "system-sharcpoint.com",
          "system-sharcpointe.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/147.45.124.240/relations"
      ],
      "total": 15
    },
    {
      "counts": {
        "domain": 36
      },
      "first_seen": "2024-08-11",
      "indicators": {
        "domain": [
          "app-sharcpoint.com",
          "app-sharcpolnt.com",
          "app-sharcpolnte.com",
          "appsharcpointe.com",
          "appsharcpointes.com",
          "appssharcpointe.com",
          "cloud-sharcpointe.com",
          "cloud-sharepolnt.com",
          "cloudsharepolnte.com",
          "doc-sharepointe.com",
          "docs-sharcpoint.com",
          "docs-sharcpolnte.com",
          "docs-sharepolnt.com",
          "secureauth-login.com",
          "serviceauth0.com",
          "sharcpoint-app.com",
          "sharcpoint-docs.com",
          "sharcpoint-web.com",
          "sharcpointapp.com",
          "sharcpointe-cloud.com",
          "sharcpointe-doc.com",
          "sharcpointecloud.com",
          "sharcpointedoc.com",
          "sharcpointedocsapp.com",
          "sharcpointedocuments.com",
          "sharcpolnte-docs.com",
          "sharcpolnte-web.com",
          "sharepointbeagle.com",
          "sharepointdesign.com",
          "sharepointe-cloud.com",
          "sharepointe-docs.com",
          "sharepolnte-docs.com",
          "sharepolnte-web.com",
          "web-sharcpoint.com",
          "web-sharcpolnt.com",
          "web-sharepolnt.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/ip-address/147.45.124.240/relations"
      ],
      "total": 36
    },
    {
      "counts": {
        "domain": 20,
        "url": 1
      },
      "first_seen": "2024-07-25",
      "indicators": {
        "domain": [
          "accounts.kv-ukr.net",
          "accounts.ukr-mails.net",
          "accounts.ukr-reset.email",
          "changepassword-ukr.net",
          "kv-ukr.net",
          "uaccsnet.com",
          "ualogaccs.com",
          "uasettings.com",
          "uasetukr.com",
          "uasystdoc.com",
          "uasystnet.com",
          "ukainua.com",
          "ukenlog.com",
          "uknetlogin.com",
          "ukr-mails.net",
          "ukr-reset.email",
          "ukrsets.com",
          "ukrsett.com",
          "ukrstnet.com",
          "unetset.com"
        ],
        "url": [
          "http://82.221.139.200"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/alex_lanstein/status/1816306001781367143",
        "https://blog.strikeready.com/blog/russia-nexus-actor-targets-ukraine/",
        "https://cert.gov.ua/article/6280183 (# UAC-0102)",
        "https://www.virustotal.com/gui/ip-address/82.221.139.200/relations",
        "https://www.virustotal.com/gui/file/e159886a173f021b345ad152ad84beed3ac39b6a7455805c255f38d7b4c9434c/detection",
        "https://www.virustotal.com/gui/file/853f21ba9a8a362a9bafc98204eb70b8c23ba845359e694984711ec1485d0c2f/detection",
        "https://www.virustotal.com/gui/file/2f1f4b077b6fc40d8f0c995e80657448478a08acdf0e33ee2b73602bda62270c/detection",
        "https://www.virustotal.com/gui/file/38963b61113b7b88e3fce30539e63b4745f8d91f8e2577b6597a09648b105733/detection",
        "https://www.virustotal.com/gui/file/9e49db0eb920e130c0393a87c96434b9f0257025584cf546f623c1cb0b074333/detection"
      ],
      "total": 21
    },
    {
      "counts": {
        "ipv4": 2
      },
      "first_seen": "2024-03-14",
      "indicators": {
        "ipv4": [
          "89.19.211.240:3000",
          "95.164.17.94:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://medium.com/@fofabot/practical-fofa-asset-discovery-coldriver-bdb971f2413b"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2024-01-18",
      "indicators": {
        "ipv4": [
          "45.133.216.15:3000"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/ (# SPICA backdoor)",
        "https://www.virustotal.com/gui/file/37c52481711631a5c73a6341bd8bea302ad57f02199db7624b580058547fb5a9/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 89
      },
      "first_seen": "2023-08-10",
      "indicators": {
        "domain": [
          "bittechllc.net",
          "centeritdefcity.com",
          "checkscreenit.com",
          "cloudcpanelhost.com",
          "clouddefsystems.com",
          "cloudrootstorage.com",
          "commandentrance.com",
          "computertechdirectsystems.com",
          "computingtechstudio.com",
          "configuregatewayglobal.com",
          "controlgatestorage.com",
          "controlsstoragedirect.com",
          "controlstoragesolutions.com",
          "cryptdatagate.com",
          "cryptotechdirect.com",
          "cryptothistech.com",
          "datagatellc.com",
          "datagatewayglobal.com",
          "datastoragecrypto.com",
          "definform.com",
          "deskactivitygm.com",
          "directdocumentgate.com",
          "directdocumentgateway.com",
          "directexpressgateway.com",
          "directstoragegate.com",
          "docsinfogate.com",
          "documentdirectllc.com",
          "documentdirectto.com",
          "entrywaycenter.com",
          "gateblurbrepository.com",
          "gatecryptospace.com",
          "gateinfosecure.com",
          "gatestoragetech.com",
          "gatewaydocsint.com",
          "gatewayitsol.com",
          "gatewayrecord.com",
          "gawecryptoinfosolutions.com",
          "getinfostarter.com",
          "incappcloud.com",
          "infocryptogate.com",
          "infogatestorage.com",
          "informationcoindata.com",
          "informationswitchsystems.com",
          "infostorageroute.com",
          "intelligencerepository.com",
          "itgatestorage.com",
          "itinfogate.com",
          "keepitlabgroup.com",
          "managercodepro.com",
          "meshgoin.com",
          "myitappnext.com",
          "myittechnext.com",
          "networkgoin.com",
          "oneinformationcrypto.com",
          "pdfdirectglobal.com",
          "pdfsecxcloudroute.com",
          "po.vatangate.com",
          "prodefendme.com",
          "prokeeperit.com",
          "protectedviews.com",
          "protectordocumentcenter.com",
          "realeasyconfiguregateway.com",
          "realitsolutionprimary.com",
          "safetydocsgateway.com",
          "secureglobaltele.com",
          "serverguarditweb.com",
          "shielditlabel.com",
          "shortinfoonline.com",
          "skycithereforeit.com",
          "solutionsseccloud.com",
          "sourcedoorway.com",
          "sourcedoorways.com",
          "stateinfospace.com",
          "storagecryptogate.com",
          "storagecryptoweb.com",
          "storageinfogate.com",
          "storagekeeperinfopro.com",
          "storagekeeperinfotech.com",
          "storagerootconnect.com",
          "storagetruncservices.com",
          "storagewarden.com",
          "suppdatacent.com",
          "truncstorage.com",
          "vatangate.com",
          "webgateway.ru",
          "webgatewayenter.com",
          "webinterstellar.com",
          "yourdirectinfospace.com",
          "yourspaceprotector.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2023-08-09-v10390/852"
      ],
      "total": 89
    },
    {
      "counts": {
        "domain": 82
      },
      "first_seen": "2022-12-07",
      "indicators": {
        "domain": [
          "access-confirmation.com",
          "allow-access.com",
          "antibots-service.com",
          "apicomcloud.com",
          "as-mvd.ru",
          "attach-docs.com",
          "attach-update.com",
          "blueskynetwork-drive.com",
          "blueskynetwork-shared.com",
          "botguard-checker.com",
          "botguard-web.com",
          "challenge-identifier.com",
          "challenge-share.com",
          "checker-bot.com",
          "cija-docs.com",
          "cija-drive.com",
          "cloud-safety.online",
          "cloud-us.online",
          "default-dns.online",
          "disk-previewer.com",
          "dns-cache.online",
          "dns-challenge.com",
          "dns-cookie.com",
          "dns-mvd.ru",
          "docs-cache.online",
          "docs-collector.com",
          "docs-storage-ltd.com",
          "docs-viewer.online",
          "docs-web.online",
          "document-guard.com",
          "document-sender.com",
          "drive-control.com",
          "drive-defender.com",
          "drive-global-ordnance.com",
          "drive-globalordnance.com",
          "drive-information.com",
          "drive-previewer.com",
          "drive-us.online",
          "dtgruelle-drive.com",
          "dtgruelle-us.com",
          "encompass-drive.com",
          "encompass-shared.com",
          "filter-bot.com",
          "global-ordnance-drive.com",
          "goweb-protect.com",
          "goweb-service.com",
          "guard-checker.com",
          "hd-centre-drive.com",
          "hd-docs-share.com",
          "hypertextttech.com",
          "land-of-service.com",
          "live-identifier.com",
          "mvd-cloud.ru",
          "mvd-redir.ru",
          "network-storage-ltd.com",
          "nonviolent-conflict-service.com",
          "nonviolent-conflict-storage.com",
          "online-word.com",
          "preview-docs.com",
          "preview-docs.online",
          "protectedshields-storage.com",
          "protection-web-app.com",
          "proxycrioisolation.com",
          "redir-document.com",
          "response-collector.com",
          "response-filter.com",
          "response-mvd.ru",
          "response-redir.com",
          "safe-proof.com",
          "sangrail-ltd.com",
          "sangrail-share.com",
          "selector-drafts.online",
          "share-drive-ua.com",
          "soaringeagle-drive.com",
          "threatcenterofreaserch.com",
          "threatcenterofresearch.com",
          "transfer-dns.com",
          "transfer-record.com",
          "umo-drive.com",
          "umopl-drive.com",
          "umopl.com",
          "webview-service.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.sekoia.io/calisto-show-interests-into-entities-involved-in-ukraine-war-support/",
        "https://otx.alienvault.com/pulse/6390ecc150d6fda9ab97c604"
      ],
      "total": 82
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2022-12-06",
      "indicators": {
        "domain": [
          "accounts.hypertexttech.com",
          "goo-ink.online",
          "hypertexttech.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/blue-callisto-orbits-around-us.html"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 36
      },
      "first_seen": "2022-08-16",
      "indicators": {
        "domain": [
          "cache-dns-forwarding.com",
          "cache-dns-preview.com",
          "cache-services.live",
          "cloud-drive.live",
          "cloud-mail.online",
          "cloud-storage.live",
          "docs-forwarding.online",
          "docs-info.online",
          "docs-shared.online",
          "docs-view.online",
          "document-forwarding.com",
          "document-online.live",
          "document-preview.com",
          "document-share.live",
          "document-view.live",
          "documents-online.live",
          "documents-view.live",
          "goo-link.online",
          "mail-docs.online",
          "office365-online.live",
          "officeonline365.live",
          "online-document.live",
          "online-storage.live",
          "online365-office.com",
          "onlinecloud365.live",
          "pdf-cache.com",
          "protection-checklinks.xyz",
          "proton-pdf.online",
          "proton-reader.com",
          "relogin-dashboard.online",
          "safe-connection.online",
          "safelinks-protect.live",
          "secureoffice.live",
          "word-yand.live",
          "y-ml.co",
          "yandx-online.cloud"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"
      ],
      "total": 36
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-07-20",
      "indicators": {
        "domain": [
          "cache-pdf.online",
          "pdf-cache.online",
          "pdf-forwarding.online",
          "storage-service.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/r0ny_123/status/1549751626004500481"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2022-06-23",
      "indicators": {
        "domain": [
          "cache-docs.com",
          "cloud-docs.com",
          "docs-cache.com",
          "docs-drive.online",
          "docs-info.com",
          "documents-cloud.com",
          "documents-pdf.online",
          "drive-docs.com",
          "file-milgov.systems",
          "hypertextteches.com",
          "office-protection.online",
          "pdf-cloud.online",
          "pdf-docs.online",
          "pdf-shared.online",
          "protectionmail.online",
          "proton-docs.com",
          "proton-view.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign/"
      ],
      "total": 17
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-06-23",
      "indicators": {
        "domain": [
          "documents-cloud.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign/",
        "https://twitter.com/r0ny_123/status/1549751626004500481"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-06-20",
      "indicators": {
        "domain": [
          "cache-pdf.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1538940189015429122",
        "https://www.virustotal.com/gui/file/7b95747eeea196c1485d089fa47a06bacb07d06399603d3a4fa153c21ce0a9ba/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2022-05-04",
      "indicators": {
        "domain": [
          "cache-dns.com",
          "docs-shared.com",
          "documents-forwarding.com",
          "documents-preview.com",
          "protection-link.online",
          "webresources.live"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/6272996039678903e0b73dd5"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2022-03-30",
      "indicators": {
        "domain": [
          "drive-share.live",
          "protect-link.online",
          "protection-office.live",
          "proton-viewer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.google/threat-analysis-group/tracking-cyber-activity-eastern-europe/"
      ],
      "total": 4
    }
  ]
}