{
  "name": "From South America to Southeast Asia: The Fragile Web of REF7707",
  "slug": "from-south-america-to-southeast-asia-the-fragile-web-of-ref7707",
  "description": "While the REF7707 campaign is characterized by a well-engineered, highly capable, novel intrusion set, the campaign owners exhibited poor campaign management and inconsistent evasion practices.",
  "published": "2025-02-12T20:39:52+00:00",
  "created_at": "2025-02-12T20:39:52+00:00",
  "modified_at": "2025-02-12T20:53:50+00:00",
  "created_at_opencti": "2025-02-12T20:39:52+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-12",
    "certutil",
    "finaldraft",
    "guidloader",
    "linux",
    "lolbas",
    "lolbin",
    "pathloader",
    "persistence",
    "powershell",
    "ref7707",
    "remote admin",
    "scheduled task",
    "siestagraph",
    "southeast asia",
    "typo squatting",
    "windows"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "8.213.217.182"
      },
      {
        "id": "",
        "name": "47.83.8.198"
      },
      {
        "id": "",
        "name": "47.239.0.216"
      },
      {
        "id": "",
        "name": "8.218.153.45"
      },
      {
        "id": "",
        "name": "https://support.vmphere.com"
      },
      {
        "id": "",
        "name": "update.hobiter.com"
      },
      {
        "id": "",
        "name": "support.vmphere.com"
      },
      {
        "id": "",
        "name": "support.fortineat.com"
      },
      {
        "id": "",
        "name": "poster.checkponit.com"
      },
      {
        "id": "",
        "name": "ict.ictnsc.com"
      },
      {
        "id": "",
        "name": "pol.vm-clouds.net"
      },
      {
        "id": "",
        "name": "digert.ictnsc.com"
      },
      {
        "id": "",
        "name": "cloud.autodiscovar.com"
      },
      {
        "id": "",
        "name": "vm-clouds.net"
      },
      {
        "id": "",
        "name": "vmphere.com"
      },
      {
        "id": "",
        "name": "mrd0x.com"
      },
      {
        "id": "",
        "name": "ictnsc.com"
      },
      {
        "id": "",
        "name": "hobiter.com"
      },
      {
        "id": "",
        "name": "d-links.net"
      },
      {
        "id": "",
        "name": "checkponit.com"
      },
      {
        "id": "",
        "name": "autodiscovar.com"
      },
      {
        "id": "",
        "name": "f90420847e1f2378ac8c52463038724533a9183f02ce9ad025a6a10fd4327f12"
      },
      {
        "id": "",
        "name": "f45661ea4959a944ca2917454d1314546cc0c88537479e00550eef05bed5b1b9"
      },
      {
        "id": "",
        "name": "d9fc1cab72d857b1e4852d414862ed8eab1d42960c1fd643985d352c148a6461"
      },
      {
        "id": "",
        "name": "f29779049f1fc2d45e43d866a845c45dc9aed6c2d9bbf99a8b1bdacfac2d52f2"
      },
      {
        "id": "",
        "name": "cffca467b6ff4dee8391c68650a53f4f3828a0b5a31a9aa501d2272b683205f9"
      },
      {
        "id": "",
        "name": "9a11d6fcf76583f7f70ff55297fb550fed774b61f35ee2edd95cf6f959853bcf"
      },
      {
        "id": "",
        "name": "842d6ddb7b26fdb1656235293ebf77c683608f8f312ed917074b30fbd5e8b43d"
      },
      {
        "id": "",
        "name": "83406905710e52f6af35b4b3c27549a12c28a628c492429d3a411fdb2d28cc8c"
      },
      {
        "id": "",
        "name": "7cd14d3e564a68434e3b705db41bddeb51dbb7d5425fd901c5ec904dbb7b6af0"
      },
      {
        "id": "",
        "name": "6d79dfb00da88bb20770ffad636c884bad515def4f8e97e9a9d61473297617e3"
      },
      {
        "id": "",
        "name": "5e3dbfd543909ff09e343339e4e64f78c874641b4fe9d68367c4d1024fe79249"
      },
      {
        "id": "",
        "name": "49e383ab6d092ba40e12a255e37ba7997f26239f82bebcd28efaa428254d30e1"
      },
      {
        "id": "",
        "name": "41141e3bdde2a7aebf329ec546745149144eff584b7fe878da7a2ad8391017b9"
      },
      {
        "id": "",
        "name": "41a3a518cc8abad677bb2723e05e2f052509a6f33ea75f32bd6603c96b721081"
      },
      {
        "id": "",
        "name": "39e85de1b1121dc38a33eca97c41dbd9210124162c6d669d28480c833e059530"
      },
      {
        "id": "",
        "name": "33f3a8ef2c5fbd45030385b634e40eaa264acbaeb7be851cbf04b62bbe575e75"
      },
      {
        "id": "",
        "name": "20508edac0ca872b7977d1d2b04425aaa999ecf0b8d362c0400abb58bd686f92"
      },
      {
        "id": "",
        "name": "17b2c6723c11348ab438891bc52d0b29f38fc435c6ba091d4464f9f2a1b926e0"
      },
      {
        "id": "",
        "name": "08331f33d196ced23bb568689c950b39ff7734b7461d9501c404e2b1dc298cc1"
      }
    ],
    "malware": [
      {
        "id": "98ce1581-ea07-4c0f-8654-086e9a523335",
        "name": "FINALDRAFT",
        "slug": "finaldraft"
      },
      {
        "id": "6578f89f-b050-4581-9e0a-ea2db08d8951",
        "name": "GUILOADER",
        "slug": "guiloader"
      },
      {
        "id": "b9f0bc72-a544-43b7-b296-3ad5827fa59c",
        "name": "PATHLOADER",
        "slug": "pathloader"
      }
    ],
    "attack_patterns": [
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://www.elastic.co/security-labs/fragile-web-ref7707",
    "https://otx.alienvault.com/pulse/67ad1528608f24b71bcea41b"
  ]
}