{ "type": "bundle", "id": "bundle--68bbe2a9-da4f-45e0-9a9a-853b278201df", "objects": [ { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec", "created": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "definition_type": "statement", "definition": { "statement": "SCOPE LIMITATION: this bundle establishes what ONE public GitLab repository contained on 2026-09-08 and what its single commit records, and nothing beyond that. The endpoint was contacted once on 2026-09-08 and the second stage was retrieved and preserved, but it was NEVER EXECUTED and not deobfuscated, so everything stated about the payload's capability is derived from reading the loader and not from observing what it did. NO ATTRIBUTION to any named actor, group or nation-state is made or supported. The git author name and email are SELF-ASSERTED, UNSIGNED metadata, are not identification of any real person, and must not be used to identify or characterise anyone of that name. The individual whose social-media account carried the approach is treated as a PROBABLE VICTIM of account takeover or impersonation, is named nowhere in this bundle, and no identifier of that person appears in it. A company whose brand and company page were circulated during the approach is NOT alleged to have been breached or to have any connection to this repository; Lifted Holdings LLC makes NO FINDING as to whether that page is operated by it, could not corroborate it independently because that company's own website returned HTTP 503 on 2026-09-08, and has asked no platform to act against it. That company, its brand and its domains are deliberately absent from this bundle and must not be inferred into it. GitLab, GitHub, the serverless hosting platform and the mail provider named in these indicators are ABUSED PLATFORMS, not parties to the activity. DO NOT BLOCK the *.vercel.app parent zone, and note that the platform's shared anycast address is deliberately excluded from this bundle." } }, { "type": "identity", "spec_version": "2.1", "id": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "created": "2026-08-06T16:42:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "name": "Lifted Holdings LLC", "description": "Payments and technology company, Tennessee, USA. Reporter and analyst of record for LH-IR-2026-0908-PROPFI. Analyst: Daniel Wilson Kemp, Founder & CEO. Contact: will@liftedholdings.com / https://liftedholdings.com", "identity_class": "organization", "sectors": [ "financial-services", "technology" ], "contact_information": "will@liftedholdings.com", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "malware", "spec_version": "2.1", "id": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "JOBLURE Node.js environment-exfiltration loader (LH-2026-004)", "description": "Fourteen lines of Node.js delivered inside an otherwise ordinary property-classifieds application presented as a startup MVP for pre-meeting review. An async function is defined in an auth controller, omitted from module.exports, and self-invoked on the same line as its closing brace, so it runs as a side effect of require() rather than from any route. It base64-decodes a C2 URL held in config, POSTs the entire process.env - which dotenv has already populated from any local .env file - under a static x-secret-header, then passes the response body to new Function.constructor(\"require\", )(require), compiling remote text in global scope with a live require threaded in. That turns arbitrary remote text into full Node capability. A reassuring success message is printed AFTER the second stage has already run. There are no npm install lifecycle scripts, so a clone or an install alone does not fire it; it fires on npm start, npm run dev, a bare node server/app.js, or any tool that requires the controller. NAMING CAVEAT: JOBLURE is Lifted Holdings' own working label for this advisory. It is NOT an industry-recognised family name and asserts no linkage to any named actor or tracked cluster. is_family is true because the same idioms and the same endpoint appear in at least 21 OSV/GHSA advisories for removed npm packages published 2026-04-16 to 2026-08-29 and in third-party preserved samples. The second stage was retrieved on 2026-09-08 and preserved unexecuted, so its behaviour is unknown.", "malware_types": [ "backdoor", "downloader" ], "is_family": true, "implementation_languages": [ "javascript" ], "capabilities": [ "exfiltrates-data", "installs-other-components" ], "first_seen": "2026-04-16T20:36:13.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec" ], "external_references": [ { "source_name": "Lifted Holdings LLC", "description": "Repository cloned read-only 2026-09-08T13:49:05Z; the GitLab project returned 404 for a window at 14:11:54Z, 22 minutes 49 seconds later, and was publicly retrievable again (HTTP 200) at 15:54:54Z. It was still live at publication. Nothing from the repository was installed or executed.", "external_id": "LH-IR-2026-0908-PROPFI" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a6eba436-9f2b-4a10-87d5-d5a6100c92b7", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Phishing: Spearphishing via Service", "description": "A cold approach on a professional social network led to an invitation to review a private startup MVP repository before a scheduled meeting. The delivery channel is the social platform, not email. The account that carried the approach is treated as a probable victim of takeover or impersonation and is not identified here.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566.003", "url": "https://attack.mitre.org/techniques/T1566/003/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--399ba106-42cc-43bd-98a7-cb785d3d87b5", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Supply Chain Compromise: Compromise Software Dependencies and Development Tools", "description": "The malicious code ships inside a project the target is asked to build and run on their own workstation. The same endpoint and idioms were previously delivered through at least 21 npm packages, all since removed from the registry.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1195.001", "url": "https://attack.mitre.org/techniques/T1195/001/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c726b442-c026-436c-878b-4740addf0ed1", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Command and Scripting Interpreter: JavaScript", "description": "new Function.constructor(\"require\", )(require) at auth.controller.js:78 compiles the HTTP response body as JavaScript in global scope and injects a live require, giving the compiled text access to fs, net and child_process.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059.007", "url": "https://attack.mitre.org/techniques/T1059/007/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--579c63e4-44b1-4f5b-9850-289c04192bb5", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Deobfuscate/Decode Files or Information", "description": "The C2 URL is stored base64-encoded at config.js:64 and decoded at runtime with atob() at auth.controller.js:73. It is the only URL in the repository that is encoded, and the literal string 'base64' appears nowhere in the 56 tracked files.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1140", "url": "https://attack.mitre.org/techniques/T1140/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--17da8405-f236-4aab-b3be-d5938a3d229d", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Unsecured Credentials", "description": "The whole of process.env is captured with {...process.env}. dotenv runs first at config.js:1, so any local .env file has already been merged in: database URLs, API keys, cloud credentials and CI tokens leave in one request, along with USER, HOSTNAME and PATH, which double as target triage.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1552", "url": "https://attack.mitre.org/techniques/T1552/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--77053f05-a788-451f-aa91-e3d437de8971", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Exfiltration Over C2 Channel", "description": "The captured environment is sent as the JSON body of a single HTTPS POST to the same endpoint that returns the second stage, under the static header x-secret-header: secret.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1041", "url": "https://attack.mitre.org/techniques/T1041/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--43363474-ec89-4294-9cf0-d47242bfa6fb", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Ingress Tool Transfer", "description": "CAPABILITY, NOT OBSERVED BEHAVIOUR ON A VICTIM. The response body is executed, so the operator can deliver arbitrary follow-on code and can serve different content per victim, or nothing at all to a researcher. The second stage WAS retrieved on 2026-09-08 and is held as evidence (SHA-256 88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c), but it was never executed or deobfuscated, so its behaviour is uncharacterised. One real constraint on the operator: axios parses a JSON response into an object, so a stage served as application/json would be stringified and throw; a working payload requires text/plain or application/javascript.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1105", "url": "https://attack.mitre.org/techniques/T1105/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--042f5937-1995-458c-8197-700a8c82bc40", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Impersonation", "description": "Four different identities were presented in connection with one opportunity: the repository name, the source-control group name, a website brand, and a company page presenting itself as an established firm in the sector. Reported as OBSERVED AND UNEXPLAINED. No finding is made against any of those third parties and none of them is named in this bundle.", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1656", "url": "https://attack.mitre.org/techniques/T1656/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a7ddb886-6aa3-44e0-81bc-65555dd6852b", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "C2 hostname - BLOCK THIS EXACT HOST, DO NOT BLOCK THE PARENT ZONE", "description": "Operator-controlled endpoint that receives the exfiltrated environment and returns the executed second stage. Named in at least 21 OSV/GHSA advisories between 2026-04-16 and 2026-08-29. DO NOT BLOCK *.vercel.app or the vercel.app parent zone: it is shared serverless hosting for very large numbers of legitimate sites and a wholesale block causes widespread collateral outage. The platform's shared anycast address is deliberately excluded from this bundle for the same reason.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'ipcheck-hashed.vercel.app']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-16T20:36:13.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--01214ba2-26f1-479d-9079-a1291e08c7ef", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "C2 URL in this sample (base64-encoded at config.js:64)", "description": "Receives the full process.env by HTTP POST; the response body is executed as Node code. NOT PROVISIONED FOR THIS REPORTER: the identical URL, path token included, was published as an indicator on 2026-04-16 in MAL-2026-2891 / GHSA-7cq2-px9f-cq3g for npm chai-as-init, months before this lure was delivered. Across the 21 advisories the path tokens cluster rather than rotate per victim, so the token behaves as a per-campaign identifier, not a per-target one.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://ipcheck-hashed.vercel.app/api/auth/b4dadd6a26d820d08596']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-16T20:36:13.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a051b9f-5258-4de6-b090-d1251c805625", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "C2 URL - dominant path variant across the kit family", "description": "Present in 17 of the 21 OSV advisories naming this host. valid_from is the earliest advisory date in that set; OSV publishes dates, not times.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-11T00:00:00.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--84df97fc-7484-440d-ad76-f84f50045321", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "C2 URL - third path variant", "description": "npm package chai-as-sets, OSV MAL-2026-10519, published 2026-07-14.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://ipcheck-hashed.vercel.app/api/auth/00fbe23fd7efc30639f1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-07-14T00:00:00.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--db123159-e890-4de5-91f2-05c7389aea8f", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "C2 URL - fourth path convention (/api/identity/)", "description": "Observed 2026-09-08 in a public third-party GitHub repository, in server/config/constant.js, disguised among genuine blockchain RPC constants. Reported as an indicator only; WE MAKE NO ALLEGATION about who controls that account, which may itself be compromised or fabricated.", "indicator_types": [ "anomalous-activity" ], "pattern": "[url:value = 'https://ipcheck-hashed.vercel.app/api/identity/1a6e008f91d4ca2566f4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T00:00:00.000Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59a25e32-1475-4ed8-b617-e37a9bde05f0", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Static exfiltration request header - most durable network signature", "description": "The POST carries x-secret-header: secret, by which the operator separates a real victim from a crawler. IT SURVIVES ROTATION OF THE HOST, which makes it the most durable network signature in the case. An outbound request carrying this header from a developer workstation, build agent or CI runner is a strong compromise indicator. Corroborated in third-party preserved samples of this kit.", "indicator_types": [ "malicious-activity" ], "pattern": "[network-traffic:extensions.'http-request-ext'.request_header.'x-secret-header' = 'secret']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--905c1c16-45d0-4661-b996-d26a2df5d9bf", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Committed base64 endpoint literal - highest-fidelity content hunt term", "description": "The literal exactly as committed at server/config/config.js:64. Greppable without decoding and it cannot occur by accident; re-encoding the decoded URL reproduces it byte for byte.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'aHR0cHM6Ly9pcGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBwL2FwaS9hdXRoL2I0ZGFkZDZhMjZkODIwZDA4NTk2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--934902dc-7e11-48d3-bc71-9a795241d9a0", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Hostname base64-encoded at the three byte-phase alignments", "description": "cGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBw is phase 2 and is OBSERVED here, because https:// is 8 bytes so the hostname starts at offset 8. aXBjaGVjay1oYXNoZWQudmVyY2VsLmFw (phase 0) and Y2hlY2staGFzaGVkLnZlcmNlbC5h (phase 1) are DERIVED BY COMPUTATION and were NOT observed in any sample we hold. Leading and trailing partial groups are dropped so all three stay valid when the hostname sits inside a larger blob with a path after it.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'cGNoZWNrLWhhc2hlZC52ZXJjZWwuYXBw' OR artifact:payload_bin MATCHES 'aXBjaGVjay1oYXNoZWQudmVyY2VsLmFw' OR artifact:payload_bin MATCHES 'Y2hlY2staGFzaGVkLnZlcmNlbC5h']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 75, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--04300a87-6c7f-4d60-81d7-fb7a32e5fb36", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Sample-specific source strings", "description": "The comment at config.js:63 ('HASHED ENDPOINT for IP Logger'), the config key HASHED_URL at :64, the loader name ipLogger at auth.controller.js:71, and the two console strings at :79 ('The request was completed successfully!', printed AFTER the second stage has already executed) and :82 ('The request was failed: ', note the trailing space). SAMPLE-SPECIFIC AND PERISHABLE: the operator appears to rename identifiers per lure, and ipLogger alone is a plausible name in benign request-logging middleware. Use only alongside a behavioural marker.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'HASHED ENDPOINT for IP Logger' OR artifact:payload_bin MATCHES 'HASHED_URL' OR artifact:payload_bin MATCHES 'The request was (completed successfully!|failed: )']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--18274e6b-b0d3-4020-9dc6-160751f22d35", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Execution primitive - Function constructor with a require parameter", "description": "auth.controller.js:78. THE DURABLE BEHAVIOURAL SIGNATURE: it survives rotation of the host, the path token and every identifier name. The low-false-positive anchor is the literal PARAMETER NAME require, which returned zero hits across every node_modules tree on the analysis workstation, whereas legitimate users of new Function() (template compilers, JSONPath libraries, expression evaluators) do not name a parameter require. Also reported publicly in the parenthesised form new (Function.constructor)(\"require\", responseData). The regex below uses a wildcard in place of the quote character; the companion YARA rule lh-2026-004.yar carries the precise form.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'new\\\\s*\\\\(?\\\\s*Function\\\\s*\\\\.\\\\s*constructor\\\\s*\\\\)?\\\\s*\\\\(\\\\s*.require.']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0ecf80e-d9bc-49ff-902d-c53100bb2a2f", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Whole-environment capture co-occurring with the kit's static header", "description": "auth.controller.js:74 and :75. THE TWO HALVES MUST BE HUNTED TOGETHER. {...process.env} is NOT rare on its own - 168 files across one ordinary workstation's dependency trees contain it - and carries signal only in combination with the kit header or an execution primitive. Never promote the environment-spread half to a standalone hunt.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES '\\\\{\\\\s*\\\\.\\\\.\\\\.\\\\s*process\\\\s*\\\\.\\\\s*env\\\\s*\\\\}' AND artifact:payload_bin MATCHES 'x-secret-header']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--907b9e00-f415-4f89-b4d7-093971396fd1", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Kit fingerprint - vestigial setApiKey atob wrapper with zero callers", "description": "server/providers/helper.js:19. Nothing in the repository calls it. An identically-named export appears in at least two third-party preserved samples of this kit, which is what makes it a kit fingerprint rather than an idiom.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'setApiKey\\\\s*[:=]\\\\s*\\\\(?\\\\s*s\\\\s*\\\\)?\\\\s*=>\\\\s*\\\\{?\\\\s*(return\\\\s+)?atob\\\\s*\\\\(\\\\s*s\\\\s*\\\\)']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 85, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e498e1b7-4198-42ac-a153-cacb9b8f79af", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "File hashes - the two payload-bearing files", "description": "server/controllers/auth.controller.js, THE PAYLOAD FILE: defines ipLogger at :71-84, self-invokes it at :84, and omits it from module.exports at :123-128. LF 825645305f5f8d7efafe57597532ccd9fd94f295a668a902eefe494eb19edaa8 (3772 bytes); CRLF 591b2a040bd86a9786e7cd2c6481f4b986604701aab0f396ffd495c8da007180 (3900 bytes); blob 8b76436c8d79a562349fa0da3000b09ba6fc5881. server/config/config.js, which carries the base64 C2 literal at :64 under the comment at :63 and calls dotenv at :1. LF ca5de7cc33ed3c4c64438393920e0ece14fac0ef90e61ba54d06fb4e67f3bd23 (2640 bytes); CRLF 296f9467fb92d923802e71ac726e0b28739a6f7681b68d019920a422b39b8afa (2727 bytes); blob 76ca26e4d8a2a3ce4fbabcd2c03f18d378284a67. HASH CONVENTION FOR EVERY VALUE IN THIS BUNDLE: the canonical LF hash is given first and is what a Linux or macOS reader computes; the second value is the SAME FILE as checked out on Windows with core.autocrlf=true. The difference is line-ending normalisation only, not local editing - each byte delta equals that file's line count exactly and git status --porcelain was empty. The git blob SHA-1 is an identity pointer within the repository and NOT an integrity proof, since SHA-1 is collision-attackable.", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '825645305f5f8d7efafe57597532ccd9fd94f295a668a902eefe494eb19edaa8' OR file:hashes.'SHA-256' = '591b2a040bd86a9786e7cd2c6481f4b986604701aab0f396ffd495c8da007180' OR file:hashes.'SHA-256' = 'ca5de7cc33ed3c4c64438393920e0ece14fac0ef90e61ba54d06fb4e67f3bd23' OR file:hashes.'SHA-256' = '296f9467fb92d923802e71ac726e0b28739a6f7681b68d019920a422b39b8afa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 100, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--914baefe-712c-4704-a9e8-c76b23650b52", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "File hashes - carrier and lure files, NOT THEMSELVES MALICIOUS", "description": "Published so a reader can confirm they hold the same artifact. NONE OF THESE FILES CONTAINS MALICIOUS CODE; they are the delivery scaffolding, and a match on one of them alone means only that the reader has this repository. server/routes/auth.js, the require carrier - :5 requires ../controllers/auth.controller, which detonates the payload from server/app.js:25. LF 95e58482769d5bb16f50fa543598b54e7cf92923b76bccda5dffe64746074f6c (407 bytes); CRLF 0c96648907d2b58a25d14dbc84d63b1946e30721fab3d368d04c3f8605f85ad6 (426 bytes); blob f341bf79d4757e5d658cf21320e0543f44f452df. server/providers/helper.js, holding the unused setApiKey wrapper at :19. LF cdbb8fb7b49733452dcb3a03d4742474f9456d688b50a6727ca7a952cc3e1ebb (968 bytes); CRLF c84d83b340334bc0fa023e5076ca30ac28acf8a1b5da9d47a5a4bf72faaee045 (996 bytes); blob 2bc8615575fc0b153d8cbabfc3e0119ebd082602. server/app.js - :25 requires ./routes/auth, the detonation point, before routes are mounted at :56-60 and before server.listen at :64; its mongoose.connect, body-parser, morgan and CORS blocks at :33-51 are commented out, so the application cannot function while the payload still fires. LF 9b24b1ee74c18d95f38f0120fc6edaa887a96bb19f2bd8f3d77ba112a163f00f (1974 bytes); CRLF d86255ce0b1f763c9f62f383a559bc54bd2b4fac84195f7e77830c301190abcd (2040 bytes); blob 76ac3e7c36ff5e4fa0d1536142a1692a7434ff17. package.json - declares start and dev as the identical string at :55-56 and NO install lifecycle scripts, so npm install alone does not fire the payload; it also declares ethers, @walletconnect/web3-provider and paytmchecksum, none of which is imported anywhere. LF 72fd374cd8d47b4ab43accf56c96095e7f6b6615c8a33d7d1c730a13e255d4d0 (2506 bytes); CRLF 6f3ca3d6fcb39c166d17211e03d23f8a275c580b90c33dd902bac05152876c8d (2597 bytes); blob 5eeb55e1fd92183af24ad555f5df6db19293820a. README.md, the lure text - titled 'Tokenized Real Estate Investment Platform', it specifies Node 18+ at :7 and instructs the reader to run npm start at :29. LF 170872e580bdabd9bcc5f0970e26193729eda45fed5bfe3692f82e9b8e51d855 (922 bytes); CRLF 6e463ab46db71bac397dd231e8288d784914a65f99fee18736cdfdbde16b56fd (980 bytes); blob 3c618cbfb5630222849e4984c9d5ebf61c51ed03. HASH CONVENTION FOR EVERY VALUE IN THIS BUNDLE: the canonical LF hash is given first and is what a Linux or macOS reader computes; the second value is the SAME FILE as checked out on Windows with core.autocrlf=true. The difference is line-ending normalisation only, not local editing - each byte delta equals that file's line count exactly and git status --porcelain was empty. The git blob SHA-1 is an identity pointer within the repository and NOT an integrity proof, since SHA-1 is collision-attackable.", "indicator_types": [ "anomalous-activity" ], "pattern": "[file:hashes.'SHA-256' = '95e58482769d5bb16f50fa543598b54e7cf92923b76bccda5dffe64746074f6c' OR file:hashes.'SHA-256' = '0c96648907d2b58a25d14dbc84d63b1946e30721fab3d368d04c3f8605f85ad6' OR file:hashes.'SHA-256' = 'cdbb8fb7b49733452dcb3a03d4742474f9456d688b50a6727ca7a952cc3e1ebb' OR file:hashes.'SHA-256' = 'c84d83b340334bc0fa023e5076ca30ac28acf8a1b5da9d47a5a4bf72faaee045' OR file:hashes.'SHA-256' = '9b24b1ee74c18d95f38f0120fc6edaa887a96bb19f2bd8f3d77ba112a163f00f' OR file:hashes.'SHA-256' = 'd86255ce0b1f763c9f62f383a559bc54bd2b4fac84195f7e77830c301190abcd' OR file:hashes.'SHA-256' = '72fd374cd8d47b4ab43accf56c96095e7f6b6615c8a33d7d1c730a13e255d4d0' OR file:hashes.'SHA-256' = '6f3ca3d6fcb39c166d17211e03d23f8a275c580b90c33dd902bac05152876c8d' OR file:hashes.'SHA-256' = '170872e580bdabd9bcc5f0970e26193729eda45fed5bfe3692f82e9b8e51d855' OR file:hashes.'SHA-256' = '6e463ab46db71bac397dd231e8288d784914a65f99fee18736cdfdbde16b56fd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T13:49:05.000Z", "confidence": 100, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f435d2d1-09f8-4807-bf67-c92b44ddf6b7", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Lure repository", "description": "Project id 86202262. Public when cloned read-only at 2026-09-08T13:49:05Z; the API and web view returned 404 and 302 during a window at 14:11:54Z, 22 minutes 49 seconds later, and the project API, web view, commit record and raw file contents were all publicly retrievable again (HTTP 200) at 15:54:54Z. STILL LIVE AT PUBLICATION. The project creation and push records are reproducible at https://gitlab.com/api/v4/projects/86202262 and its /events subpath, and GitLab is invited to confirm or correct them. GitLab Inc. is an abused platform here, not a party.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://gitlab.com/propfi-2026/mvp']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T02:29:41.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cb0cde68-05b0-4ef6-a7af-2690019ec37f", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Operator-controlled source-control namespace - REPRODUCIBLE TIMELINE ANCHOR", "description": "Group id 141655099, created 2026-09-08T02:17:00.434Z, still resolving at 14:27:13Z and listing the mvp project at 15:54:54Z. This is a reproducible anchor and it carries the point on its own: the namespace was created the same day the approach arrived, while the single commit claims a date 24 days earlier.", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://gitlab.com/groups/propfi-2026']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T02:17:00.000Z", "confidence": 95, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c7c0966-3643-4199-aae5-edd0165b7ecd", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Single rootless commit - GIT SHA-1 IDENTIFIER, NOT A FILE HASH", "description": "b86fe2450ddd078154ef45b18924a5685f8232d6, subject 'Re-init', parent_ids empty, no GPG signature, author identical to committer, root tree 1c604d01bb711a453c554d33e4a43cd31f65276a. Force-pushed at 2026-09-08T02:32:44.937Z, replacing GitLab's own auto-generated initial commit c29d47e225cd22b505ebf5fe2c41a292fc872852 and destroying whatever history existed. DO NOT INGEST THIS AS A SHA-256 FILE HASH: it is a git SHA-1 object identifier and SHA-1 is collision-attackable, so it is an identity pointer, not an integrity proof. The self-asserted commit date 2026-08-15T10:14:23-05:00 is freely settable and is not evidence of when anything happened. The pattern matches the identifier as text, which is how a defender hunts it.", "indicator_types": [ "malicious-activity" ], "pattern": "[artifact:payload_bin MATCHES 'b86fe2450ddd078154ef45b18924a5685f8232d6']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T02:32:44.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd3f1d40-6a53-4492-9c4f-3c1bd14fe82d", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Third-party repository carrying the same C2 host - NO ALLEGATION ABOUT THE ACCOUNT", "description": "A public GitHub repository observed 2026-09-08 containing the same C2 hostname at a different path in server/config/constant.js, among genuine blockchain RPC constants. We report the URL as an indicator and MAKE NO ALLEGATION ABOUT WHO CONTROLS THE ACCOUNT; it may itself be compromised or fabricated, and preservation repositories of this kit are maintained by researchers and victims. No allegation against GitHub Inc.", "indicator_types": [ "anomalous-activity" ], "pattern": "[url:value = 'https://github.com/danxeth436/eSTOKyam']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-09-08T00:00:00.000Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9ca782e9-29c7-4c83-9dd2-749614f6dfef", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Removed npm packages documented as using this endpoint", "description": "The 21 npm packages named in OSV/GHSA advisories published 2026-04-16 to 2026-08-29 as contacting this host, all now removed from the registry. Hunt lockfiles, CI caches and archived node_modules; per those advisories, any host that installed one should be treated as fully compromised. MITIGATION NOTE: none of them is documented as using an npm install lifecycle hook - chai-dec fires when its exported middleware factory is invoked, chai-defender on require(), and the sample in this advisory on require() as a module-load side effect. npm install --ignore-scripts DOES NOT DEFEND against any of them.", "indicator_types": [ "malicious-activity" ], "pattern": "[software:name IN ('chai-as-init', 'chai-dec', 'chai-as-const', 'chai-as-doc', 'chai-as-auth', 'chai-as-sets', 'chai-as-act', 'chai-as-smart', 'chai-as-byte', 'chai-as-soul', 'chai-as-otc', 'chai-as-org', 'chai-smart', 'cookie-sign', 'cookie-phase', 'motion-lib', 'motion-pull', 'web-pool', 'web-pop', 'configration', 'eth-pino')]", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-16T20:36:13.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3330a6d2-50b2-43f2-a211-91b674badc89", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "Third-party reported hashes for a related npm package - UNVERIFIED", "description": "lib/initializeCaller.js (fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad) and package.json (cb36fcdc10b8fb077ba9ebf442a53b851683ee6c86f953da370938098eced313) from npm chai-dec@2.3.5, per OSV MAL-2026-5606 / GHSA-782j-c8c3-2j5w (https://api.osv.dev/v1/vulns/MAL-2026-5606). UNVERIFIED, THIRD-PARTY REPORTED: we did not obtain or verify those files, and we have not diffed that package against this sample. Our kit-family assessment rests on shared code idioms and host-naming convention, not on binary comparison.", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'fc61b0ed62e346bfbb5e1e093e475d8b3065247dc8d315f0ea4e7cafd9661bad' OR file:hashes.'SHA-256' = 'cb36fcdc10b8fb077ba9ebf442a53b851683ee6c86f953da370938098eced313']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-06-11T00:00:00.000Z", "confidence": 40, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec" ] }, { "type": "note", "spec_version": "2.1", "id": "note--a025288a-3a50-481b-a674-ec8c0349414e", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "abstract": "What we did not find - negative results and confidence statement", "content": "WHAT WE DID NOT FIND. (1) WE CONTACTED THE ENDPOINT TWICE on 2026-09-08 (see LH-2026-004 section 4.5): a GET returned HTTP 404 and a POST carrying the loader's static header, with an EMPTY JSON body and no environment data, returned HTTP 200 and the second stage. Prior to those two requests it had not been resolved, requested, scanned or probed by the reporter or anyone acting for the reporter. We cannot say what it serves to other requesters, or whether it filters by source address. If a scanner submission is ever made this statement will be amended rather than left standing, because a submission causes the scanning service to fetch the URL. (2) WE DID NOT ESTABLISH WHO OPERATES THE REPOSITORY. The commit's author name, email and timestamp are self-asserted, unsigned and freely settable; we made no attempt to identify a real person and we link the name to no individual. (3) NO ATTRIBUTION. Vendor literature describes techniques of the same shape as tradecraft it attributes to a state actor; we do not adopt that attribution. Techniques are not identities, kits like this are copied and reused by unrelated operators, and this sample contains no artifact that distinguishes one operator from another. (4) THE PATH TOKEN IS NOT PER-VICTIM. It was published as an indicator on 2026-04-16 for an npm package, nearly five months before the approach reached the reporter and four months before the date the commit claims for itself. (5) The project returned 404 for a window on 2026-09-08 and was publicly retrievable again at 15:54:54Z; its creation and push records are reproducible at the endpoints given, and the GROUP creation time and the project record are both reproducible anchors. (6) We found no certificate-transparency record for the hostname (crt.sh, 2026-09-08; the service was intermittently returning HTTP 502 when we rechecked, so the negative is not reliably reproducible on demand). We obtained no statement from the hosting provider about how project subdomains are certified, so we draw NO conclusion about whether certificate transparency can see this class of host. (7) We could not query VirusTotal - no credential was available - so its verdict is UNKNOWN TO US and nobody should assume it is clean. (8) urlscan.io held no public record of the host on 2026-09-08 (total: 0); anonymous search sees only public scans, so that is an absence in one source, not evidence the infrastructure is unknown to the industry. (9) We could not search GitLab source code: its blob-search API returns HTTP 401 to anonymous callers, so sibling GitLab-hosted lures are invisible to this research. THIS IS THE SINGLE LARGEST GAP IN OUR COVERAGE. (10) Do not use this sample's own identifier names as a general hunting signature; they appear to be renamed per lure. Hunt the behaviour. (11) We have NOT diffed this repository against the publicly documented samples it resembles. (12) We did not deep-parse the two glTF binaries as container formats; they were string-scanned only. (13) NO FINDING AGAINST ANY THIRD-PARTY BRAND. A company page presenting itself as an established firm in this sector was circulated during the approach. We found no evidence that firm was breached or has any connection to this repository, we make NO FINDING as to whether that page is operated by it, we could not corroborate it independently because that firm's website returned HTTP 503 to every retrieval on 2026-09-08, and we asked no platform to act against the page. No such firm, brand or domain is named in this bundle and none may be inferred into it. (14) THE INDIVIDUAL WHOSE ACCOUNT CARRIED THE APPROACH IS TREATED AS A VICTIM. Account takeover and impersonation are both consistent with what we can see and both make that person a victim. We did not attempt to contact, identify or investigate them, and no identifier of that person appears in this bundle or in the accompanying indicator feed. (15) REGARDING OUR OWN ORGANISATION: the repository was cloned read-only; npm install, npm start and every file in it were never executed, and no Lifted Holdings credentials, environment or systems were exposed to this code. (16) DETECTION CAVEAT worth repeating so it is not misused: {...process.env} is COMMON in legitimate tooling - 168 occurrences in one workstation's dependency trees - and carries signal only alongside the execution primitive. Never hunt on it alone. (17) The companion YARA rule file matches on indicator strings as well as behaviour, so it will match this bundle, any feed quoting it, and the rule file itself; it carries a documentation guard for convenience, but exclude your threat-intel document store from scanning rather than relying on that guard.", "object_refs": [ "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "indicator--a7ddb886-6aa3-44e0-81bc-65555dd6852b", "indicator--01214ba2-26f1-479d-9079-a1291e08c7ef", "indicator--5a051b9f-5258-4de6-b090-d1251c805625", "indicator--84df97fc-7484-440d-ad76-f84f50045321", "indicator--db123159-e890-4de5-91f2-05c7389aea8f", "indicator--59a25e32-1475-4ed8-b617-e37a9bde05f0", "indicator--905c1c16-45d0-4661-b996-d26a2df5d9bf", "indicator--934902dc-7e11-48d3-bc71-9a795241d9a0", "indicator--04300a87-6c7f-4d60-81d7-fb7a32e5fb36", "indicator--18274e6b-b0d3-4020-9dc6-160751f22d35", "indicator--c0ecf80e-d9bc-49ff-902d-c53100bb2a2f", "indicator--907b9e00-f415-4f89-b4d7-093971396fd1", "indicator--e498e1b7-4198-42ac-a153-cacb9b8f79af", "indicator--914baefe-712c-4704-a9e8-c76b23650b52", "indicator--f435d2d1-09f8-4807-bf67-c92b44ddf6b7", "indicator--cb0cde68-05b0-4ef6-a7af-2690019ec37f", "indicator--8c7c0966-3643-4199-aae5-edd0165b7ecd", "indicator--bd3f1d40-6a53-4492-9c4f-3c1bd14fe82d", "indicator--9ca782e9-29c7-4c83-9dd2-749614f6dfef", "indicator--3330a6d2-50b2-43f2-a211-91b674badc89" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--8aefed99-4bf1-4756-bafb-de7f78e786ec" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--23ea0766-d389-4057-aed4-8c79df8521d2", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--a7ddb886-6aa3-44e0-81bc-65555dd6852b", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--36ba908b-e413-4899-a0f4-d43baa1c16c3", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--01214ba2-26f1-479d-9079-a1291e08c7ef", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9aba7e13-74d8-45cd-a076-9358336265ef", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--5a051b9f-5258-4de6-b090-d1251c805625", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--08837ee8-8830-4b47-86df-6e2558780afc", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--84df97fc-7484-440d-ad76-f84f50045321", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--db78feda-63ff-4e2c-8be8-2bb3f8e77d18", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--db123159-e890-4de5-91f2-05c7389aea8f", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--39507247-1065-48c1-ae4f-a74af413e9d1", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--59a25e32-1475-4ed8-b617-e37a9bde05f0", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5b226d1-5daf-4764-a885-e3bbaf8204f5", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--905c1c16-45d0-4661-b996-d26a2df5d9bf", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--006cc417-045d-4bab-94b6-90e014977f48", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--934902dc-7e11-48d3-bc71-9a795241d9a0", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a66dc288-87aa-46e3-830b-14e98ee0c61a", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--04300a87-6c7f-4d60-81d7-fb7a32e5fb36", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8b0c0675-dd7d-42f5-b6e7-aa9318b7d1a7", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--18274e6b-b0d3-4020-9dc6-160751f22d35", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--82943600-4108-4062-b483-412b044fff8c", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--c0ecf80e-d9bc-49ff-902d-c53100bb2a2f", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1689fab7-8407-4642-b6b8-f43cfea434b8", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--907b9e00-f415-4f89-b4d7-093971396fd1", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f61acb1-6904-4b14-b7be-0a64415cd298", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--e498e1b7-4198-42ac-a153-cacb9b8f79af", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--28a4d232-18c1-49da-b1e7-fecf45857e72", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--914baefe-712c-4704-a9e8-c76b23650b52", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5eb7ca4-0a37-4af7-8517-7acc1abc31a7", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--f435d2d1-09f8-4807-bf67-c92b44ddf6b7", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--22dab1c3-53a4-4dd0-a390-d337caf79d48", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--cb0cde68-05b0-4ef6-a7af-2690019ec37f", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--275bdff9-a356-42b7-97a5-7e05c9fcad5d", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--8c7c0966-3643-4199-aae5-edd0165b7ecd", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--2a743544-62bc-4a68-a386-1ff53dc219fb", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--bd3f1d40-6a53-4492-9c4f-3c1bd14fe82d", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--14f02563-18c5-479b-9f08-6d279c357bd8", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--9ca782e9-29c7-4c83-9dd2-749614f6dfef", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--32d44656-e5ba-4044-b564-171269943b32", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--3330a6d2-50b2-43f2-a211-91b674badc89", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5d20f02-9cca-4c3f-955d-bc4918ff4acc", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--a6eba436-9f2b-4a10-87d5-d5a6100c92b7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--585fd264-36bf-4e2d-8e76-c728fcc92d2f", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--399ba106-42cc-43bd-98a7-cb785d3d87b5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bea0a72-bdc9-46da-add6-70e56dafa8bd", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--c726b442-c026-436c-878b-4740addf0ed1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--19815e60-83d7-48b4-9ec9-ea6d8ca7d191", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--579c63e4-44b1-4f5b-9850-289c04192bb5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9ed17865-7472-44c5-97f0-8f10c999484e", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--17da8405-f236-4aab-b3be-d5938a3d229d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6f0c1fda-b139-467a-8db1-437400bafa59", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--77053f05-a788-451f-aa91-e3d437de8971" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b27ba7eb-4cd6-4515-a691-cb26840e0466", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--43363474-ec89-4294-9cf0-d47242bfa6fb", "description": "CAPABILITY ONLY, CAPABILITY. The second stage was retrieved on 2026-09-08 and preserved, but never executed, so its behaviour is uncharacterised.", "confidence": 50 }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--40b9a04e-068f-4fa2-af9d-26a6b2b48e08", "created": "2026-09-08T15:00:00.000Z", "modified": "2026-09-08T15:00:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "uses", "source_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6", "target_ref": "attack-pattern--042f5937-1995-458c-8197-700a8c82bc40", "description": "Identity layering reported as OBSERVED AND UNEXPLAINED. No finding is made against any third party whose brand appeared, and none is named.", "confidence": 70 }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f4a1c7e2-3b58-4d90-a1c6-8e2f5b7d0a34", "created": "2026-09-08T15:30:00.000Z", "modified": "2026-09-08T15:30:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "name": "LH-2026-004 second-stage payload served 2026-09-08", "description": "The 4,070,107-byte obfuscated JavaScript body returned by the C2 on 2026-09-08 to a POST carrying the loader's static header. Held as evidence; NEVER EXECUTED and not deobfuscated, so no behavioural claim is made about it. All string literals sit in a rotated lookup table, so plaintext search of the file yields no hosts, paths or filenames. The operator may serve different bytes per victim or per request: a non-match does NOT clear a host.", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '88d8da1b1148a07973cd1ec96d1f67d4f672b83635ec342783c1df6e38a4ad0c']", "pattern_type": "stix", "valid_from": "2026-09-08T14:18:00.000Z", "confidence": 90, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--8c2d5f1a-9e46-4b73-b0d8-1f6a3c9e5b27", "created": "2026-09-08T15:30:00.000Z", "modified": "2026-09-08T15:30:00.000Z", "created_by_ref": "identity--3a9c1f70-2b48-4d19-9e6c-5f8a0b1c2d3e", "relationship_type": "indicates", "source_ref": "indicator--f4a1c7e2-3b58-4d90-a1c6-8e2f5b7d0a34", "target_ref": "malware--7e89e0b8-ab32-47f6-a802-a9a6dd5896c6" } ] }