{
  "aliases": [
    "CVE-2023-41991",
    "CVE-2023-41992",
    "CVE-2023-41993",
    "Cytrox Predator"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 127
  },
  "first_seen": {
    "domain": {
      "1domainregistry.com": "2024-09-14",
      "almal-news.com": "2023-09-22",
      "asistentcomercialonline.com": "2026-01-02",
      "barbequebros.com": "2026-01-02",
      "beinfo.net": "2024-09-14",
      "bestshowineu.com": "2024-09-14",
      "betly.me": "2023-09-22",
      "blocoinformativo.com": "2024-09-14",
      "bni-madagascar.com": "2024-03-04",
      "boundbreeze.com": "2026-01-02",
      "branchbreeze.com": "2026-01-02",
      "buysalesblog.com": "2024-09-14",
      "c.betly.me": "2023-09-22",
      "c1tvapp.com": "2024-09-14",
      "c3p0solutions.com": "2026-01-02",
      "cabinet-salyk.kz": "2024-03-04",
      "caddylane.com": "2024-09-14",
      "canylane.com": "2026-01-02",
      "chat-support.support": "2023-09-22",
      "cheesyarcade.com": "2024-09-14",
      "cibeg.online": "2023-09-22",
      "clockpatcher.com": "2026-01-02",
      "colabfile.com": "2024-09-14",
      "craftilly.com": "2026-01-02",
      "despachosnegocios.com": "2024-09-14",
      "dollgoodies.com": "2026-01-02",
      "drivemountain.com": "2026-01-02",
      "e-kgd.kz": "2024-03-04",
      "eclipsemonitor.com": "2024-09-14",
      "eppointment.io": "2024-09-14",
      "eroticsmoments.com": "2024-09-14",
      "espeednet.com": "2024-09-14",
      "flickerxxx.com": "2024-09-14",
      "fr-monde.com": "2024-03-04",
      "fruitynew.com": "2024-09-06",
      "g.sec-flare.com": "2023-09-22",
      "gameformovies.com": "2024-09-06",
      "gamestuts.com": "2026-01-02",
      "gardalul.com": "2024-09-14",
      "gettravelright.com": "2026-01-02",
      "gilfonts.com": "2026-01-02",
      "gobbledgums.com": "2026-01-02",
      "happytotstoys.com": "2024-09-06",
      "healthyhub.io": "2024-09-14",
      "holidaypriceguide.com": "2024-09-06",
      "humansprinter.com": "2024-09-14",
      "infoaomomento.com": "2024-09-06",
      "infoshoutout.com": "2024-09-14",
      "jumia-egy.com": "2024-03-04",
      "keep-badinigroups.com": "2024-09-14",
      "kejoranews.net": "2024-03-04",
      "lawrdo.com": "2026-01-02",
      "lesautreseux.com": "2024-09-06",
      "locmap.org": "2024-09-14",
      "longtester.com": "2026-01-02",
      "mappins.io": "2026-01-02",
      "mapsloc.net": "2024-09-14",
      "masoloyakati.com": "2024-09-06",
      "mdundobeats.com": "2024-09-14",
      "mmegi.co": "2024-03-04",
      "mountinnovate.com": "2026-01-02",
      "mundoautopro.com": "2026-01-02",
      "myfawry.net": "2024-03-04",
      "myowndrive.net": "2024-09-14",
      "mypinpoint.org": "2024-09-14",
      "myprivatedrive.net": "2024-09-14",
      "myread.io": "2026-01-02",
      "mystudyup.com": "2024-09-14",
      "newsfunnel.net": "2024-09-14",
      "nightskyco.com": "2026-01-02",
      "noadsview.com": "2024-09-14",
      "noisyball.com": "2024-09-06",
      "noticiafamosos.com": "2024-09-14",
      "noticiafresca.net": "2026-01-02",
      "notifications-sec.com": "2023-09-22",
      "notifications.wa-info.com": "2023-09-22",
      "nuurs.net": "2024-09-14",
      "nyirangongovrai.com": "2024-09-06",
      "onelifestyle24.com": "2024-09-14",
      "openstreetpro.com": "2026-01-02",
      "pedalmastery.com": "2024-09-14",
      "pepalaunch-airdrop.info": "2024-09-14",
      "pinnedplace.com": "2024-09-14",
      "promobyfit.com": "2024-09-14",
      "remixspot.com": "2026-01-02",
      "rhapresentacao.com": "2024-09-06",
      "roadsidefoodie.com": "2026-01-02",
      "runconnect.net": "2024-09-14",
      "sdntribune.co": "2024-03-04",
      "sec-flare.com": "2023-09-22",
      "secneed.com": "2024-09-14",
      "secretspotnow.com": "2024-09-14",
      "secsafty.com": "2024-09-14",
      "shopstodrop.com": "2024-09-14",
      "southchinapost.net": "2023-10-12",
      "speedbrawse.com": "2024-09-14",
      "stableconnect.net": "2026-01-02",
      "starryedge.com": "2026-01-02",
      "statuepops.com": "2026-01-02",
      "steepmatch.com": "2026-01-02",
      "streamable-vid.com": "2026-01-02",
      "street-maps.net": "2024-09-14",
      "strictplace.com": "2026-01-02",
      "suarapapua.co": "2024-03-04",
      "summerspooks.com": "2024-09-14",
      "svcsync.com": "2024-09-14",
      "t-bit.me": "2023-09-22",
      "themastersphere.com": "2026-01-02",
      "toysfourtots.com": "2024-09-06",
      "traillites.com": "2026-01-02",
      "trigship.com": "2024-09-14",
      "ulstur.co": "2024-03-04",
      "unibilateral.com": "2026-01-02",
      "updatepoints.com": "2024-09-14",
      "verifyurl.me": "2023-09-22",
      "vlast-news.com": "2024-03-04",
      "vslojasvendas.com": "2024-09-14",
      "wa-info.com": "2023-09-22",
      "web.whatssapp.co": "2023-09-22",
      "whatspp.wa-info.com": "2023-09-22",
      "whatssap.whatssapp.co": "2023-09-22",
      "whatssapp.co": "2023-09-22",
      "wtar.io": "2026-01-02",
      "wts-app.info": "2023-09-22",
      "yo-um7.com": "2024-03-04",
      "yokananu.net": "2024-09-06",
      "zipzone.io": "2026-01-02"
    }
  },
  "first_seen_precision": {
    "domain": {
      "asistentcomercialonline.com": "at-or-before",
      "barbequebros.com": "at-or-before",
      "boundbreeze.com": "at-or-before",
      "branchbreeze.com": "at-or-before",
      "c3p0solutions.com": "at-or-before",
      "canylane.com": "at-or-before",
      "clockpatcher.com": "at-or-before",
      "craftilly.com": "at-or-before",
      "dollgoodies.com": "at-or-before",
      "drivemountain.com": "at-or-before",
      "gamestuts.com": "at-or-before",
      "gettravelright.com": "at-or-before",
      "gilfonts.com": "at-or-before",
      "gobbledgums.com": "at-or-before",
      "lawrdo.com": "at-or-before",
      "longtester.com": "at-or-before",
      "mappins.io": "at-or-before",
      "mountinnovate.com": "at-or-before",
      "mundoautopro.com": "at-or-before",
      "myread.io": "at-or-before",
      "nightskyco.com": "at-or-before",
      "noticiafresca.net": "at-or-before",
      "openstreetpro.com": "at-or-before",
      "remixspot.com": "at-or-before",
      "roadsidefoodie.com": "at-or-before",
      "stableconnect.net": "at-or-before",
      "starryedge.com": "at-or-before",
      "statuepops.com": "at-or-before",
      "steepmatch.com": "at-or-before",
      "streamable-vid.com": "at-or-before",
      "strictplace.com": "at-or-before",
      "themastersphere.com": "at-or-before",
      "traillites.com": "at-or-before",
      "unibilateral.com": "at-or-before",
      "wtar.io": "at-or-before",
      "zipzone.io": "at-or-before"
    }
  },
  "first_seen_range": {
    "earliest": "2023-09-22",
    "latest": "2026-01-02"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "1domainregistry.com",
      "almal-news.com",
      "asistentcomercialonline.com",
      "barbequebros.com",
      "beinfo.net",
      "bestshowineu.com",
      "betly.me",
      "blocoinformativo.com",
      "bni-madagascar.com",
      "boundbreeze.com",
      "branchbreeze.com",
      "buysalesblog.com",
      "c.betly.me",
      "c1tvapp.com",
      "c3p0solutions.com",
      "cabinet-salyk.kz",
      "caddylane.com",
      "canylane.com",
      "chat-support.support",
      "cheesyarcade.com",
      "cibeg.online",
      "clockpatcher.com",
      "colabfile.com",
      "craftilly.com",
      "despachosnegocios.com",
      "dollgoodies.com",
      "drivemountain.com",
      "e-kgd.kz",
      "eclipsemonitor.com",
      "eppointment.io",
      "eroticsmoments.com",
      "espeednet.com",
      "flickerxxx.com",
      "fr-monde.com",
      "fruitynew.com",
      "g.sec-flare.com",
      "gameformovies.com",
      "gamestuts.com",
      "gardalul.com",
      "gettravelright.com",
      "gilfonts.com",
      "gobbledgums.com",
      "happytotstoys.com",
      "healthyhub.io",
      "holidaypriceguide.com",
      "humansprinter.com",
      "infoaomomento.com",
      "infoshoutout.com",
      "jumia-egy.com",
      "keep-badinigroups.com",
      "kejoranews.net",
      "lawrdo.com",
      "lesautreseux.com",
      "locmap.org",
      "longtester.com",
      "mappins.io",
      "mapsloc.net",
      "masoloyakati.com",
      "mdundobeats.com",
      "mmegi.co",
      "mountinnovate.com",
      "mundoautopro.com",
      "myfawry.net",
      "myowndrive.net",
      "mypinpoint.org",
      "myprivatedrive.net",
      "myread.io",
      "mystudyup.com",
      "newsfunnel.net",
      "nightskyco.com",
      "noadsview.com",
      "noisyball.com",
      "noticiafamosos.com",
      "noticiafresca.net",
      "notifications-sec.com",
      "notifications.wa-info.com",
      "nuurs.net",
      "nyirangongovrai.com",
      "onelifestyle24.com",
      "openstreetpro.com",
      "pedalmastery.com",
      "pepalaunch-airdrop.info",
      "pinnedplace.com",
      "promobyfit.com",
      "remixspot.com",
      "rhapresentacao.com",
      "roadsidefoodie.com",
      "runconnect.net",
      "sdntribune.co",
      "sec-flare.com",
      "secneed.com",
      "secretspotnow.com",
      "secsafty.com",
      "shopstodrop.com",
      "southchinapost.net",
      "speedbrawse.com",
      "stableconnect.net",
      "starryedge.com",
      "statuepops.com",
      "steepmatch.com",
      "streamable-vid.com",
      "street-maps.net",
      "strictplace.com",
      "suarapapua.co",
      "summerspooks.com",
      "svcsync.com",
      "t-bit.me",
      "themastersphere.com",
      "toysfourtots.com",
      "traillites.com",
      "trigship.com",
      "ulstur.co",
      "unibilateral.com",
      "updatepoints.com",
      "verifyurl.me",
      "vlast-news.com",
      "vslojasvendas.com",
      "wa-info.com",
      "web.whatssapp.co",
      "whatspp.wa-info.com",
      "whatssap.whatssapp.co",
      "whatssapp.co",
      "wtar.io",
      "wts-app.info",
      "yo-um7.com",
      "yokananu.net",
      "zipzone.io"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "PREDATOR"
  ],
  "references": [
    "https://blog.sekoia.io/the-predator-spyware-ecosystem-is-not-dead/",
    "https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/",
    "https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-11-v10437/1028",
    "https://github.com/SpyGuard/SpyGuard/commit/5d2c914d55089aa67fecd1ab065d085b4051fd4c",
    "https://www.recordedfuture.com/research/predator-spyware-infrastructure-returns-following-exposure-sanctions",
    "https://www.recordedfuture.com/research/predator-still-active-new-links-identified",
    "https://www.virustotal.com/gui/ip-address/169.239.129.76/relations",
    "https://www.virustotal.com/gui/ip-address/185.123.102.40/relations",
    "https://www.virustotal.com/gui/ip-address/185.235.137.6/relations",
    "https://www.virustotal.com/gui/ip-address/185.243.113.169/relations",
    "https://www.virustotal.com/gui/ip-address/192.169.7.252/relations",
    "https://www.virustotal.com/gui/ip-address/193.29.56.252/relations",
    "https://www.virustotal.com/gui/ip-address/193.29.59.164/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.14.241/relations",
    "https://www.virustotal.com/gui/ip-address/2.58.15.120/relations",
    "https://www.virustotal.com/gui/ip-address/45.86.163.178/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.68.136/relations",
    "https://www.virustotal.com/gui/ip-address/5.230.78.27/relations",
    "https://www.virustotal.com/gui/ip-address/98.142.253.18/relations",
    "https://x.com/felixaime/status/1834939287202099248"
  ],
  "related": [],
  "slug": "PREDATOR",
  "timeline": [
    {
      "counts": {
        "domain": 36
      },
      "first_seen": "2026-01-02",
      "indicators": {
        "domain": [
          "asistentcomercialonline.com",
          "barbequebros.com",
          "boundbreeze.com",
          "branchbreeze.com",
          "c3p0solutions.com",
          "canylane.com",
          "clockpatcher.com",
          "craftilly.com",
          "dollgoodies.com",
          "drivemountain.com",
          "gamestuts.com",
          "gettravelright.com",
          "gilfonts.com",
          "gobbledgums.com",
          "lawrdo.com",
          "longtester.com",
          "mappins.io",
          "mountinnovate.com",
          "mundoautopro.com",
          "myread.io",
          "nightskyco.com",
          "noticiafresca.net",
          "openstreetpro.com",
          "remixspot.com",
          "roadsidefoodie.com",
          "stableconnect.net",
          "starryedge.com",
          "statuepops.com",
          "steepmatch.com",
          "streamable-vid.com",
          "strictplace.com",
          "themastersphere.com",
          "traillites.com",
          "unibilateral.com",
          "wtar.io",
          "zipzone.io"
        ]
      },
      "precision": "at-or-before",
      "references": [
        "https://www.recordedfuture.com/research/predator-still-active-new-links-identified"
      ],
      "total": 36
    },
    {
      "counts": {
        "domain": 48
      },
      "first_seen": "2024-09-14",
      "indicators": {
        "domain": [
          "1domainregistry.com",
          "beinfo.net",
          "bestshowineu.com",
          "blocoinformativo.com",
          "buysalesblog.com",
          "c1tvapp.com",
          "caddylane.com",
          "cheesyarcade.com",
          "colabfile.com",
          "despachosnegocios.com",
          "eclipsemonitor.com",
          "eppointment.io",
          "eroticsmoments.com",
          "espeednet.com",
          "flickerxxx.com",
          "gardalul.com",
          "healthyhub.io",
          "humansprinter.com",
          "infoshoutout.com",
          "keep-badinigroups.com",
          "locmap.org",
          "mapsloc.net",
          "mdundobeats.com",
          "myowndrive.net",
          "mypinpoint.org",
          "myprivatedrive.net",
          "mystudyup.com",
          "newsfunnel.net",
          "noadsview.com",
          "noticiafamosos.com",
          "nuurs.net",
          "onelifestyle24.com",
          "pedalmastery.com",
          "pepalaunch-airdrop.info",
          "pinnedplace.com",
          "promobyfit.com",
          "runconnect.net",
          "secneed.com",
          "secretspotnow.com",
          "secsafty.com",
          "shopstodrop.com",
          "speedbrawse.com",
          "street-maps.net",
          "summerspooks.com",
          "svcsync.com",
          "trigship.com",
          "updatepoints.com",
          "vslojasvendas.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://x.com/felixaime/status/1834939287202099248",
        "https://github.com/SpyGuard/SpyGuard/commit/5d2c914d55089aa67fecd1ab065d085b4051fd4c"
      ],
      "total": 48
    },
    {
      "counts": {
        "domain": 12
      },
      "first_seen": "2024-09-06",
      "indicators": {
        "domain": [
          "fruitynew.com",
          "gameformovies.com",
          "happytotstoys.com",
          "holidaypriceguide.com",
          "infoaomomento.com",
          "lesautreseux.com",
          "masoloyakati.com",
          "noisyball.com",
          "nyirangongovrai.com",
          "rhapresentacao.com",
          "toysfourtots.com",
          "yokananu.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.recordedfuture.com/research/predator-spyware-infrastructure-returns-following-exposure-sanctions",
        "https://www.virustotal.com/gui/ip-address/169.239.129.76/relations",
        "https://www.virustotal.com/gui/ip-address/185.123.102.40/relations",
        "https://www.virustotal.com/gui/ip-address/185.235.137.6/relations",
        "https://www.virustotal.com/gui/ip-address/185.243.113.169/relations",
        "https://www.virustotal.com/gui/ip-address/193.29.56.252/relations",
        "https://www.virustotal.com/gui/ip-address/193.29.59.164/relations",
        "https://www.virustotal.com/gui/ip-address/45.86.163.178/relations",
        "https://www.virustotal.com/gui/ip-address/98.142.253.18/relations"
      ],
      "total": 12
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2024-03-04",
      "indicators": {
        "domain": [
          "bni-madagascar.com",
          "cabinet-salyk.kz",
          "e-kgd.kz",
          "fr-monde.com",
          "jumia-egy.com",
          "kejoranews.net",
          "mmegi.co",
          "myfawry.net",
          "sdntribune.co",
          "suarapapua.co",
          "ulstur.co",
          "vlast-news.com",
          "yo-um7.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://blog.sekoia.io/the-predator-spyware-ecosystem-is-not-dead/"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-10-12",
      "indicators": {
        "domain": [
          "southchinapost.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://community.emergingthreats.net/t/ruleset-update-summary-2023-10-11-v10437/1028"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 17
      },
      "first_seen": "2023-09-22",
      "indicators": {
        "domain": [
          "almal-news.com",
          "betly.me",
          "c.betly.me",
          "chat-support.support",
          "cibeg.online",
          "g.sec-flare.com",
          "notifications-sec.com",
          "notifications.wa-info.com",
          "sec-flare.com",
          "t-bit.me",
          "verifyurl.me",
          "wa-info.com",
          "web.whatssapp.co",
          "whatspp.wa-info.com",
          "whatssap.whatssapp.co",
          "whatssapp.co",
          "wts-app.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/",
        "https://www.virustotal.com/gui/ip-address/192.169.7.252/relations",
        "https://www.virustotal.com/gui/ip-address/2.58.14.241/relations",
        "https://www.virustotal.com/gui/ip-address/2.58.15.120/relations",
        "https://www.virustotal.com/gui/ip-address/5.230.68.136/relations",
        "https://www.virustotal.com/gui/ip-address/5.230.78.27/relations"
      ],
      "total": 17
    }
  ]
}