{
  "aliases": [
    "exilerat",
    "luckycat",
    "sepulcher",
    "shadownet",
    "ta413"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 56,
    "ipv4": 8,
    "url": 1,
    "url_path": 2
  },
  "first_seen": {
    "domain": {
      "89757.x.gg": "2015-03-18",
      "airjaldi.online": "2022-09-27",
      "applestatic.com": "2022-09-27",
      "bailianlan.c.dwyu.com": "2015-03-18",
      "cattree.1x.biz": "2015-03-18",
      "charlesbrain.shop.co": "2015-03-18",
      "clbest.greenglassint.net": "2015-03-18",
      "dalailamatrustindia.ddns.net": "2020-09-02",
      "duojee.info": "2015-03-18",
      "fidk.rkntils.dnset.com": "2015-03-18",
      "fireequipment.website.org": "2015-03-18",
      "flex-jobs.in": "2022-09-27",
      "footballworldcup.website.org": "2015-03-18",
      "frankwhales.shop.co": "2015-03-18",
      "freetibet.in": "2022-09-27",
      "gmailcom.tw": "2019-02-05",
      "goodwell.all.co.uk": "2015-03-18",
      "havefuns.rkntils.10dig.net": "2015-03-18",
      "hi21222325.x.gg": "2015-03-18",
      "indiatrustdalailama.com": "2021-02-25",
      "jeepvihecle.shop.co": "2015-03-18",
      "jobflex.in": "2022-09-27",
      "johnnees.rkntils.10dig.net": "2015-03-18",
      "killmannets.0fees.net": "2015-03-18",
      "kinkeechow.shop.co": "2015-03-18",
      "kittyshop.kilu.org": "2015-03-18",
      "lucysmith.0fees.net": "2015-03-18",
      "maritimemaster.kilu.org": "2015-03-18",
      "masterchoice.shop.co": "2015-03-18",
      "mondaynews.tk": "2019-02-05",
      "nangsihistory.vip": "2021-02-25",
      "newsindian.xyz": "2022-09-27",
      "peopleoffreeworld.tk": "2019-02-05",
      "perfect.shop.co": "2015-03-18",
      "pumasports.website.org": "2015-03-18",
      "rediffpapers.com": "2022-09-27",
      "rkntils.10dig.net": "2015-03-18",
      "rkntils.dnset.com": "2015-03-18",
      "rukiyeangel.dyndns.pro": "2015-03-18",
      "sunshine.shop.co": "2015-03-18",
      "tb123.xoomsite.com": "2015-03-18",
      "tbda123.gwchost.com": "2015-03-18",
      "tennissport.website.org": "2015-03-18",
      "tibet-gov.web.app": "2022-05-31",
      "tibet.bet": "2022-09-27",
      "tibetancongress.com": "2022-09-27",
      "tibetanyouthcongress.com": "2022-09-27",
      "toms.0fees.net": "2015-03-18",
      "tomsburs.shop.co": "2015-03-18",
      "tomygreen.0fees.net": "2015-03-18",
      "vaccine-icmr.net": "2021-02-25",
      "vaccine-icmr.org": "2021-02-25",
      "vpoasport.shopping2000.com": "2015-03-18",
      "waterpool.website.org": "2015-03-18",
      "welfaretibet.tk": "2020-09-02",
      "you-tube.tv": "2021-02-25"
    },
    "ipv4": {
      "107.151.194.197:443": "2020-09-02",
      "107.151.194.197:8080": "2020-09-02",
      "118.99.13.4:1234": "2020-09-02",
      "118.99.13.4:8099": "2020-09-02",
      "167.179.99.136:443": "2021-02-25",
      "27.126.188.212:80": "2019-10-06",
      "27.126.188.212:8003": "2019-10-06",
      "27.126.188.212:8005": "2019-10-06"
    },
    "url": {
      "http://107.151.194.197": "2020-09-02"
    },
    "url_path": {
      "/aqqee": "2019-10-06",
      "/qqqzqa": "2018-09-21"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2015-03-18",
    "latest": "2022-09-27"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "89757.x.gg",
      "airjaldi.online",
      "applestatic.com",
      "bailianlan.c.dwyu.com",
      "cattree.1x.biz",
      "charlesbrain.shop.co",
      "clbest.greenglassint.net",
      "dalailamatrustindia.ddns.net",
      "duojee.info",
      "fidk.rkntils.dnset.com",
      "fireequipment.website.org",
      "flex-jobs.in",
      "footballworldcup.website.org",
      "frankwhales.shop.co",
      "freetibet.in",
      "gmailcom.tw",
      "goodwell.all.co.uk",
      "havefuns.rkntils.10dig.net",
      "hi21222325.x.gg",
      "indiatrustdalailama.com",
      "jeepvihecle.shop.co",
      "jobflex.in",
      "johnnees.rkntils.10dig.net",
      "killmannets.0fees.net",
      "kinkeechow.shop.co",
      "kittyshop.kilu.org",
      "lucysmith.0fees.net",
      "maritimemaster.kilu.org",
      "masterchoice.shop.co",
      "mondaynews.tk",
      "nangsihistory.vip",
      "newsindian.xyz",
      "peopleoffreeworld.tk",
      "perfect.shop.co",
      "pumasports.website.org",
      "rediffpapers.com",
      "rkntils.10dig.net",
      "rkntils.dnset.com",
      "rukiyeangel.dyndns.pro",
      "sunshine.shop.co",
      "tb123.xoomsite.com",
      "tbda123.gwchost.com",
      "tennissport.website.org",
      "tibet-gov.web.app",
      "tibet.bet",
      "tibetancongress.com",
      "tibetanyouthcongress.com",
      "toms.0fees.net",
      "tomsburs.shop.co",
      "tomygreen.0fees.net",
      "vaccine-icmr.net",
      "vaccine-icmr.org",
      "vpoasport.shopping2000.com",
      "waterpool.website.org",
      "welfaretibet.tk",
      "you-tube.tv"
    ],
    "ipv4": [
      "107.151.194.197:443",
      "107.151.194.197:8080",
      "118.99.13.4:1234",
      "118.99.13.4:8099",
      "167.179.99.136:443",
      "27.126.188.212:80",
      "27.126.188.212:8003",
      "27.126.188.212:8005"
    ],
    "url": [
      "http://107.151.194.197"
    ],
    "url_path": [
      "/aqqee",
      "/qqqzqa"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "LUCKYCAT"
  ],
  "references": [
    "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf",
    "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html",
    "https://otx.alienvault.com/pulse/5f4faad08bc69edf206bf6b6",
    "https://otx.alienvault.com/pulse/6037c5dff774e1d70491bf0d/",
    "https://twitter.com/threatinsight/status/1531688214993555457",
    "https://www.proofpoint.com/us/blog/threat-insight/chinese-apt-ta413-resumes-targeting-tibet-following-covid-19-themed-economic",
    "https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global",
    "https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets",
    "https://www.virustotal.com/gui/ip-address/134.122.129.102/relations",
    "https://www.virustotal.com/gui/ip-address/172.105.35.111/relations",
    "https://www.virustotal.com/gui/ip-address/192.46.213.63/relations"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "FAMILIARFEELING"
    }
  ],
  "slug": "LUCKYCAT",
  "timeline": [
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2022-09-27",
      "indicators": {
        "domain": [
          "airjaldi.online",
          "applestatic.com",
          "flex-jobs.in",
          "freetibet.in",
          "jobflex.in",
          "newsindian.xyz",
          "rediffpapers.com",
          "tibet.bet",
          "tibetancongress.com",
          "tibetanyouthcongress.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets",
        "https://www.virustotal.com/gui/ip-address/134.122.129.102/relations",
        "https://www.virustotal.com/gui/ip-address/172.105.35.111/relations",
        "https://www.virustotal.com/gui/ip-address/192.46.213.63/relations"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-05-31",
      "indicators": {
        "domain": [
          "tibet-gov.web.app"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/threatinsight/status/1531688214993555457"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5,
        "ipv4": 1
      },
      "first_seen": "2021-02-25",
      "indicators": {
        "domain": [
          "indiatrustdalailama.com",
          "nangsihistory.vip",
          "vaccine-icmr.net",
          "vaccine-icmr.org",
          "you-tube.tv"
        ],
        "ipv4": [
          "167.179.99.136:443"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/ta413-leverages-new-friarfox-browser-extension-target-gmail-accounts-global",
        "https://otx.alienvault.com/pulse/6037c5dff774e1d70491bf0d/"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 2,
        "ipv4": 4,
        "url": 1
      },
      "first_seen": "2020-09-02",
      "indicators": {
        "domain": [
          "dalailamatrustindia.ddns.net",
          "welfaretibet.tk"
        ],
        "ipv4": [
          "107.151.194.197:443",
          "107.151.194.197:8080",
          "118.99.13.4:1234",
          "118.99.13.4:8099"
        ],
        "url": [
          "http://107.151.194.197"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/chinese-apt-ta413-resumes-targeting-tibet-following-covid-19-themed-economic",
        "https://otx.alienvault.com/pulse/5f4faad08bc69edf206bf6b6"
      ],
      "total": 7
    },
    {
      "counts": {
        "ipv4": 3
      },
      "first_seen": "2019-10-06",
      "indicators": {
        "ipv4": [
          "27.126.188.212:80",
          "27.126.188.212:8003",
          "27.126.188.212:8005"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html"
      ],
      "total": 3
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2019-10-06",
      "indicators": {
        "url_path": [
          "/aqqee"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets",
        "https://www.virustotal.com/gui/ip-address/134.122.129.102/relations",
        "https://www.virustotal.com/gui/ip-address/172.105.35.111/relations",
        "https://www.virustotal.com/gui/ip-address/192.46.213.63/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2019-02-05",
      "indicators": {
        "domain": [
          "gmailcom.tw",
          "mondaynews.tk",
          "peopleoffreeworld.tk"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.talosintelligence.com/2019/02/exilerat-shares-c2-with-luckycat.html"
      ],
      "total": 3
    },
    {
      "counts": {
        "url_path": 1
      },
      "first_seen": "2018-09-21",
      "indicators": {
        "url_path": [
          "/qqqzqa"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/chinese-state-sponsored-group-ta413-adopts-new-capabilities-in-pursuit-of-tibetan-targets",
        "https://www.virustotal.com/gui/ip-address/134.122.129.102/relations",
        "https://www.virustotal.com/gui/ip-address/172.105.35.111/relations",
        "https://www.virustotal.com/gui/ip-address/192.46.213.63/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 35
      },
      "first_seen": "2015-03-18",
      "indicators": {
        "domain": [
          "89757.x.gg",
          "bailianlan.c.dwyu.com",
          "cattree.1x.biz",
          "charlesbrain.shop.co",
          "clbest.greenglassint.net",
          "duojee.info",
          "fidk.rkntils.dnset.com",
          "fireequipment.website.org",
          "footballworldcup.website.org",
          "frankwhales.shop.co",
          "goodwell.all.co.uk",
          "havefuns.rkntils.10dig.net",
          "hi21222325.x.gg",
          "jeepvihecle.shop.co",
          "johnnees.rkntils.10dig.net",
          "killmannets.0fees.net",
          "kinkeechow.shop.co",
          "kittyshop.kilu.org",
          "lucysmith.0fees.net",
          "maritimemaster.kilu.org",
          "masterchoice.shop.co",
          "perfect.shop.co",
          "pumasports.website.org",
          "rkntils.10dig.net",
          "rkntils.dnset.com",
          "rukiyeangel.dyndns.pro",
          "sunshine.shop.co",
          "tb123.xoomsite.com",
          "tbda123.gwchost.com",
          "tennissport.website.org",
          "toms.0fees.net",
          "tomsburs.shop.co",
          "tomygreen.0fees.net",
          "vpoasport.shopping2000.com",
          "waterpool.website.org"
        ]
      },
      "precision": "exact",
      "references": [
        "http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf"
      ],
      "total": 35
    }
  ]
}