{
  "aliases": [
    "echogather",
    "goffee"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 89,
    "url": 4
  },
  "first_seen": {
    "domain": {
      "acrobatupdate.online": "2026-08-02",
      "adobecheck.online": "2026-08-02",
      "arrotech.org": "2026-05-17",
      "awalitalk.com": "2026-01-02",
      "certcalc.online": "2026-05-17",
      "certcheck.online": "2026-08-02",
      "certinform.online": "2026-08-02",
      "easytrns.com": "2026-01-02",
      "edgeupdates.online": "2026-08-02",
      "fast-eda.my": "2026-01-02",
      "fastchessplay.com": "2026-01-02",
      "fungaros.com": "2026-01-02",
      "hakyru.com": "2026-01-02",
      "jantyroza.com": "2026-01-02",
      "ntpadjust.online": "2026-05-17",
      "ntpbayhai.online": "2026-05-17",
      "ntpcalc.online": "2026-05-17",
      "ntpchck.online": "2026-05-17",
      "ntpcheck.online": "2026-05-17",
      "ntpcorrect.online": "2026-05-17",
      "ntpedge.online": "2026-05-17",
      "ntpfetch.online": "2026-05-17",
      "ntpfix.online": "2026-05-17",
      "ntpget.online": "2026-05-17",
      "ntphaiba.online": "2026-05-17",
      "ntphaimot.online": "2026-05-17",
      "ntphaisau.online": "2026-05-17",
      "ntpinform.online": "2026-05-17",
      "ntpluck.online": "2026-05-17",
      "ntpmatch.online": "2026-05-17",
      "ntpmuoitam.online": "2026-05-17",
      "ntpnet.online": "2026-05-17",
      "ntpquirks.online": "2026-05-17",
      "ntpsetup.online": "2026-05-17",
      "ntpsum.online": "2026-05-17",
      "ntpsync.online": "2026-05-17",
      "ntptake.online": "2026-05-17",
      "ntptop.online": "2026-05-17",
      "ntptrack.online": "2026-05-17",
      "ntpverify.online": "2026-05-17",
      "ntpzone.online": "2026-05-17",
      "packetflow.online": "2026-05-17",
      "packethost.online": "2026-05-17",
      "packetlabs.online": "2026-05-17",
      "packetread.online": "2026-05-17",
      "packetsign.online": "2026-05-17",
      "packetswift.online": "2026-08-02",
      "packettake.online": "2026-05-17",
      "packetuser.online": "2026-05-17",
      "packetxhub.online": "2026-05-17",
      "phan.club": "2026-08-02",
      "ruzede.com": "2026-01-02",
      "slimer.club": "2026-08-02",
      "sslchck.online": "2026-05-17",
      "sslcom.online": "2026-05-17",
      "sslfix.online": "2026-05-17",
      "sslhttp.online": "2026-05-17",
      "sslntp.online": "2026-08-02",
      "sslpack.online": "2026-05-17",
      "sslpoll.online": "2026-05-17",
      "sslradio.online": "2026-05-17",
      "sslreach.online": "2026-05-17",
      "sslserve.online": "2026-05-17",
      "sslsign.online": "2026-05-17",
      "sslstart.online": "2026-05-17",
      "sslsum.online": "2026-05-17",
      "ssltail.online": "2026-05-17",
      "sslteam.online": "2026-05-17",
      "ssltech.online": "2026-05-17",
      "ssltick.online": "2026-05-17",
      "ssltop.online": "2026-05-17",
      "ssltrade.online": "2026-05-17",
      "ssltrick.online": "2026-05-17",
      "ssltun.online": "2026-05-17",
      "sslvalid.online": "2026-05-17",
      "timealign.online": "2026-01-02",
      "timebits.online": "2026-01-02",
      "timecheck.site": "2026-01-02",
      "timefetch.online": "2026-01-02",
      "timeget.cloud": "2026-01-02",
      "timeget.online": "2026-01-02",
      "timemaster.site": "2026-01-02",
      "timematch.online": "2026-01-02",
      "timemirror.online": "2026-01-02",
      "timesync.cloud": "2026-01-02",
      "updatestop.online": "2026-05-17",
      "woburneast.com": "2026-05-17",
      "xss.place": "2026-08-02",
      "zeccecard.com": "2026-05-17"
    },
    "url": {
      "http://193.233.18.135": "2026-05-17",
      "http://213.165.61.226": "2026-05-17",
      "http://78.153.149.182": "2026-05-17",
      "http://87.251.66.114": "2026-05-17"
    }
  },
  "first_seen_precision": {
    "domain": {
      "awalitalk.com": "at-or-before",
      "easytrns.com": "at-or-before",
      "fast-eda.my": "at-or-before",
      "fastchessplay.com": "at-or-before",
      "fungaros.com": "at-or-before",
      "hakyru.com": "at-or-before",
      "jantyroza.com": "at-or-before",
      "ruzede.com": "at-or-before",
      "timealign.online": "at-or-before",
      "timebits.online": "at-or-before",
      "timecheck.site": "at-or-before",
      "timefetch.online": "at-or-before",
      "timeget.cloud": "at-or-before",
      "timeget.online": "at-or-before",
      "timemaster.site": "at-or-before",
      "timematch.online": "at-or-before",
      "timemirror.online": "at-or-before",
      "timesync.cloud": "at-or-before"
    },
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2026-01-02",
    "latest": "2026-08-02"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "acrobatupdate.online",
      "adobecheck.online",
      "arrotech.org",
      "awalitalk.com",
      "certcalc.online",
      "certcheck.online",
      "certinform.online",
      "easytrns.com",
      "edgeupdates.online",
      "fast-eda.my",
      "fastchessplay.com",
      "fungaros.com",
      "hakyru.com",
      "jantyroza.com",
      "ntpadjust.online",
      "ntpbayhai.online",
      "ntpcalc.online",
      "ntpchck.online",
      "ntpcheck.online",
      "ntpcorrect.online",
      "ntpedge.online",
      "ntpfetch.online",
      "ntpfix.online",
      "ntpget.online",
      "ntphaiba.online",
      "ntphaimot.online",
      "ntphaisau.online",
      "ntpinform.online",
      "ntpluck.online",
      "ntpmatch.online",
      "ntpmuoitam.online",
      "ntpnet.online",
      "ntpquirks.online",
      "ntpsetup.online",
      "ntpsum.online",
      "ntpsync.online",
      "ntptake.online",
      "ntptop.online",
      "ntptrack.online",
      "ntpverify.online",
      "ntpzone.online",
      "packetflow.online",
      "packethost.online",
      "packetlabs.online",
      "packetread.online",
      "packetsign.online",
      "packetswift.online",
      "packettake.online",
      "packetuser.online",
      "packetxhub.online",
      "phan.club",
      "ruzede.com",
      "slimer.club",
      "sslchck.online",
      "sslcom.online",
      "sslfix.online",
      "sslhttp.online",
      "sslntp.online",
      "sslpack.online",
      "sslpoll.online",
      "sslradio.online",
      "sslreach.online",
      "sslserve.online",
      "sslsign.online",
      "sslstart.online",
      "sslsum.online",
      "ssltail.online",
      "sslteam.online",
      "ssltech.online",
      "ssltick.online",
      "ssltop.online",
      "ssltrade.online",
      "ssltrick.online",
      "ssltun.online",
      "sslvalid.online",
      "timealign.online",
      "timebits.online",
      "timecheck.site",
      "timefetch.online",
      "timeget.cloud",
      "timeget.online",
      "timemaster.site",
      "timematch.online",
      "timemirror.online",
      "timesync.cloud",
      "updatestop.online",
      "woburneast.com",
      "xss.place",
      "zeccecard.com"
    ],
    "url": [
      "http://193.233.18.135",
      "http://213.165.61.226",
      "http://78.153.149.182",
      "http://87.251.66.114"
    ]
  },
  "last_modified": "2026-08-02T20:00:47+00:00",
  "maltrail_groups": [
    "PAPERWEREWOLF"
  ],
  "references": [
    "https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/",
    "https://intezer.com/blog/tracing-a-paper-werewolf-campaign-through-ai-generated-decoys-and-excel-xlls/",
    "https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection",
    "https://www.virustotal.com/gui/ip-address/130.49.213.54/relations",
    "https://www.virustotal.com/gui/ip-address/193.233.18.135/relations",
    "https://www.virustotal.com/gui/ip-address/213.165.61.226/relations",
    "https://www.virustotal.com/gui/ip-address/213.165.61.50/relations",
    "https://www.virustotal.com/gui/ip-address/77.110.112.165/relations",
    "https://www.virustotal.com/gui/ip-address/78.153.149.182/relations",
    "https://www.virustotal.com/gui/ip-address/87.251.66.114/relations",
    "https://x.com/phatomcandle/status/2083976136669974980"
  ],
  "related": [],
  "slug": "PAPERWEREWOLF",
  "timeline": [
    {
      "counts": {
        "domain": 9
      },
      "first_seen": "2026-08-02",
      "indicators": {
        "domain": [
          "acrobatupdate.online",
          "adobecheck.online",
          "certcheck.online",
          "certinform.online",
          "edgeupdates.online",
          "packetswift.online",
          "phan.club",
          "slimer.club",
          "xss.place"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/phatomcandle/status/2083976136669974980",
        "https://www.virustotal.com/gui/ip-address/130.49.213.54/relations",
        "https://www.virustotal.com/gui/ip-address/213.165.61.50/relations",
        "https://www.virustotal.com/gui/ip-address/77.110.112.165/relations"
      ],
      "total": 9
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-08-02",
      "indicators": {
        "domain": [
          "sslntp.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/",
        "https://www.virustotal.com/gui/ip-address/193.233.18.135/relations",
        "https://www.virustotal.com/gui/ip-address/213.165.61.226/relations",
        "https://www.virustotal.com/gui/ip-address/78.153.149.182/relations",
        "https://www.virustotal.com/gui/ip-address/87.251.66.114/relations",
        "https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection",
        "https://x.com/phatomcandle/status/2083976136669974980",
        "https://www.virustotal.com/gui/ip-address/130.49.213.54/relations",
        "https://www.virustotal.com/gui/ip-address/213.165.61.50/relations",
        "https://www.virustotal.com/gui/ip-address/77.110.112.165/relations"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 60,
        "url": 4
      },
      "first_seen": "2026-05-17",
      "indicators": {
        "domain": [
          "arrotech.org",
          "certcalc.online",
          "ntpadjust.online",
          "ntpbayhai.online",
          "ntpcalc.online",
          "ntpchck.online",
          "ntpcheck.online",
          "ntpcorrect.online",
          "ntpedge.online",
          "ntpfetch.online",
          "ntpfix.online",
          "ntpget.online",
          "ntphaiba.online",
          "ntphaimot.online",
          "ntphaisau.online",
          "ntpinform.online",
          "ntpluck.online",
          "ntpmatch.online",
          "ntpmuoitam.online",
          "ntpnet.online",
          "ntpquirks.online",
          "ntpsetup.online",
          "ntpsum.online",
          "ntptake.online",
          "ntptop.online",
          "ntptrack.online",
          "ntpverify.online",
          "ntpzone.online",
          "packetflow.online",
          "packethost.online",
          "packetlabs.online",
          "packetread.online",
          "packetsign.online",
          "packettake.online",
          "packetuser.online",
          "packetxhub.online",
          "sslchck.online",
          "sslcom.online",
          "sslfix.online",
          "sslhttp.online",
          "sslpack.online",
          "sslpoll.online",
          "sslradio.online",
          "sslreach.online",
          "sslserve.online",
          "sslsign.online",
          "sslstart.online",
          "sslsum.online",
          "ssltail.online",
          "sslteam.online",
          "ssltech.online",
          "ssltick.online",
          "ssltop.online",
          "ssltrade.online",
          "ssltrick.online",
          "ssltun.online",
          "sslvalid.online",
          "updatestop.online",
          "woburneast.com",
          "zeccecard.com"
        ],
        "url": [
          "http://193.233.18.135",
          "http://213.165.61.226",
          "http://78.153.149.182",
          "http://87.251.66.114"
        ]
      },
      "precision": "exact",
      "references": [
        "https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/",
        "https://www.virustotal.com/gui/ip-address/193.233.18.135/relations",
        "https://www.virustotal.com/gui/ip-address/213.165.61.226/relations",
        "https://www.virustotal.com/gui/ip-address/78.153.149.182/relations",
        "https://www.virustotal.com/gui/ip-address/87.251.66.114/relations",
        "https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection"
      ],
      "total": 64
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-05-17",
      "indicators": {
        "domain": [
          "ntpsync.online"
        ]
      },
      "precision": "exact",
      "references": [
        "https://intezer.com/blog/tracing-a-paper-werewolf-campaign-through-ai-generated-decoys-and-excel-xlls/",
        "https://bi.zone/eng/expertise/blog/kamen-nozhnitsy-bumaga-novyy-instrumentariy-v-atakakh-klastera-paper-werewolf/",
        "https://www.virustotal.com/gui/ip-address/193.233.18.135/relations",
        "https://www.virustotal.com/gui/ip-address/213.165.61.226/relations",
        "https://www.virustotal.com/gui/ip-address/78.153.149.182/relations",
        "https://www.virustotal.com/gui/ip-address/87.251.66.114/relations",
        "https://www.virustotal.com/gui/file/938dac6227e47fed245ad25d289489d67e574882430652b5fb7b6368e262e873/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 18
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "awalitalk.com",
          "easytrns.com",
          "fast-eda.my",
          "fastchessplay.com",
          "fungaros.com",
          "hakyru.com",
          "jantyroza.com",
          "ruzede.com",
          "timealign.online",
          "timebits.online",
          "timecheck.site",
          "timefetch.online",
          "timeget.cloud",
          "timeget.online",
          "timemaster.site",
          "timematch.online",
          "timemirror.online",
          "timesync.cloud"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://intezer.com/blog/tracing-a-paper-werewolf-campaign-through-ai-generated-decoys-and-excel-xlls/"
      ],
      "total": 18
    }
  ]
}