{
  "name": "Interlock and Rhysida within the Ransomware Ecosystem",
  "slug": "interlock-and-rhysida-within-the-ransomware-ecosystem",
  "description": "This analysis examines over two years of observations on the ransomware ecosystem surrounding Interlock and Rhysida threat groups. Hive0163 (Interlock) employs custom malware including NodeSnake, InterlockRAT, JunkFiction downloader, Supper, and Interlock ransomware, with identified links to TAG-124. Rhysida actors utilize Endico downloader, Broomstick, Supper, and Tomb crypter, showing relationships with IceNova operators and ITG23. Strong code overlaps between NodeSnake, JunkFiction downloader, InterlockRAT and Supper indicate shared codebases or common developers. Both groups primarily target U.S. organizations across multiple sectors, using trojanized installers, ClickFix campaigns, and traffic distribution systems for initial access. Analysis of post-exploitation payloads reveals broad, adaptable toolsets including custom WDAC policies, credential phishing tools, and various privilege escalation exploits, demonstrating sophisticated ransomware operations.",
  "published": "2026-06-12T19:29:01+00:00",
  "created_at": "2026-06-12T19:29:01+00:00",
  "modified_at": "2026-06-15T16:32:30+00:00",
  "created_at_opencti": "2026-06-12T19:29:01+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-06-12",
    "CVE-2023-36036",
    "CVE-2026-20131",
    "berserk stealer",
    "broomstick",
    "clickfix",
    "dave",
    "endico",
    "gootloader",
    "icenova",
    "inc",
    "initial access broker",
    "interlock",
    "interlockrat",
    "junkfiction",
    "latrodectus",
    "mallard",
    "mintloader",
    "modelorat",
    "nodesnake",
    "ntlmthief",
    "plus keylogger",
    "portstarter",
    "ransomware",
    "rhysida",
    "sliver",
    "socgholish",
    "supper",
    "supper backdoor",
    "systembc",
    "tomb",
    "tomb crypter",
    "trojanized installers",
    "vidar"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "170.168.103.208"
      },
      {
        "id": "",
        "name": "185.233.166.26"
      },
      {
        "id": "",
        "name": "213.139.77.167"
      },
      {
        "id": "",
        "name": "64.94.84.155"
      },
      {
        "id": "",
        "name": "162.221.93.164"
      },
      {
        "id": "",
        "name": "193.36.38.139"
      },
      {
        "id": "",
        "name": "64.94.85.158"
      },
      {
        "id": "",
        "name": "199.217.99.95"
      },
      {
        "id": "",
        "name": "192.169.6.74"
      },
      {
        "id": "",
        "name": "67.217.228.180"
      },
      {
        "id": "",
        "name": "157.250.195.229"
      },
      {
        "id": "",
        "name": "198.13.158.219"
      },
      {
        "id": "",
        "name": "199.91.221.250"
      },
      {
        "id": "",
        "name": "216.219.95.234"
      },
      {
        "id": "",
        "name": "5.230.201.173"
      },
      {
        "id": "",
        "name": "185.196.9.234"
      },
      {
        "id": "",
        "name": "199.217.99.121"
      },
      {
        "id": "",
        "name": "45.84.59.21"
      },
      {
        "id": "",
        "name": "199.91.221.73"
      },
      {
        "id": "",
        "name": "38.134.148.147"
      },
      {
        "id": "",
        "name": "193.149.176.215"
      },
      {
        "id": "",
        "name": "https://apple-online.shop/ChromeSetup.exe"
      },
      {
        "id": "",
        "name": "https://leadslaw.com/MSTeamsSetup.exe"
      },
      {
        "id": "",
        "name": "https://microsoft-teams.icu/files/MSteamsV7.80.exe"
      },
      {
        "id": "",
        "name": "www.nomok-xore.com"
      },
      {
        "id": "",
        "name": "https://apple-online.shop/MSTeamsSetup.exe\\"
      },
      {
        "id": "",
        "name": "www.forever-size.com"
      },
      {
        "id": "",
        "name": "https://hire-household-squad-postcard.trycloudflare.com/MSTeamsSetup.exe"
      },
      {
        "id": "",
        "name": "https://apple-online.shop/MSTeamsSetup.exe"
      },
      {
        "id": "",
        "name": "www.deyno-xom.com"
      },
      {
        "id": "",
        "name": "https://apple-online.shop/MicrosoftEdgeSetup.exe\\"
      },
      {
        "id": "",
        "name": "41b6815d187a9bd7284fb0919b814eaf310d55452030eb932b32b27b5c473e26"
      },
      {
        "id": "",
        "name": "c8347069980e0c7b8d42cbf0f2be7bc6e558f8b6cf7ca960f6454926120adf55"
      },
      {
        "id": "",
        "name": "7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f"
      },
      {
        "id": "",
        "name": "7ed805c5fc3bd0a4eab3d523483a9cc83b8768ff667875f2318f3bfa4ef68fe2"
      },
      {
        "id": "",
        "name": "4fa8d9a20ce9098eddc065cc427e3ccb035bf3306e236c17a67104d79ca040e0"
      },
      {
        "id": "",
        "name": "dbc316c240067d5495415fca6b8fec28b0d9e41282919d7d124fc645e15f5d4c"
      },
      {
        "id": "",
        "name": "c15f44d6abb3a2a882ffdc9b90f7bb5d1a233c0aa183eb765aa8bfba5832c8c6"
      },
      {
        "id": "",
        "name": "9a0b069640a404939e48af5acec26c922bae44a8fdf26444f20ee4f7989640bc"
      },
      {
        "id": "",
        "name": "7389c2d346ef85e469a5ce47ef4cbf55bf3c58075996b8f5596e15fa257d90ad"
      },
      {
        "id": "",
        "name": "b7b451db845d2fd97996e765156ab9b0a337f58957803896bef72834d8a4d158"
      },
      {
        "id": "",
        "name": "89759f741606e3e9e3004978c08a3d8f5d8a887f13dd749c6a3653d9db9283df"
      },
      {
        "id": "",
        "name": "690b6cf4205248a3fc5521762c69a24f46958e57621dc97b031e41ec1f381221"
      },
      {
        "id": "",
        "name": "7d13460fb3a6c918bd9866e1209fbcd18603304c35240f22571c432c204dc363"
      },
      {
        "id": "",
        "name": "396eb0e817d90cf366b5648f9a97c51bfb37737af13dc4a9e1a768885a867dc5"
      },
      {
        "id": "",
        "name": "c24cb7692b77123387b821f3683966807662217a4c918c32bb97358729c33a1d"
      },
      {
        "id": "",
        "name": "12b86190ab3fb916b8901d82fbe996f43417ffa5736df5294a63a440758f158e"
      },
      {
        "id": "",
        "name": "913487d5c4514300e1f774af965d046479f0a6612061bcb82b536c7427a49102"
      },
      {
        "id": "",
        "name": "84d824231a73df2bfb1793d251f69b30fe32bba0693ff6471ac410dedbdd1d9a"
      },
      {
        "id": "",
        "name": "aa6e5529831b62cb27211b4918dd6da15ac7e69dbcc8621671dccf6df151c5a2"
      },
      {
        "id": "",
        "name": "8e2a3f32479404e195db7dbfd6ae3117122db0fcedccf7fe6abb087763f3ecf2"
      },
      {
        "id": "",
        "name": "47363515fbf02bb669f72adfdc1e52c6cdcb4fc4183832a96b5761b6d95f016c"
      },
      {
        "id": "",
        "name": "0708a518ef644a3911a717220706190fbd5e5246c533845887c5fbd967953799"
      },
      {
        "id": "",
        "name": "ff664520f263e30ee0380e496328a93701576f1312d2e33a70297a228a8a49a6"
      },
      {
        "id": "",
        "name": "b46a3f9a7917a0b0e08979f85c90ff802a3e96d23a19a8727d9d701d5e2088eb"
      },
      {
        "id": "",
        "name": "a4d0ea40eb9cdcd2da83afbe4d36a634ac85c2cb6d16a83729791cadfeb1f298"
      },
      {
        "id": "",
        "name": "27091704a872d9ebbbc3b4273a365b1fcc8dee36e1e8a7b53f6df017a26812ff"
      },
      {
        "id": "",
        "name": "a9b68f8e125da256ab5fe48e3bb4a72423927d943fe7502e20915b5ad24a5bc2"
      },
      {
        "id": "",
        "name": "b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504"
      },
      {
        "id": "",
        "name": "5811d60e80a6051ab3bd2651060fce8f1ea8d446a062625b0d2b55bb7b2bad99"
      },
      {
        "id": "",
        "name": "0edfad6a8b34b2b419fd254a99394b8f2303d144dbeba7148ef5343e2929fe76"
      },
      {
        "id": "",
        "name": "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c"
      },
      {
        "id": "",
        "name": "4fe36d2cdb90cadd834ecd6d42269e7406b439788a405bca35f0b9f7640e008a"
      },
      {
        "id": "",
        "name": "55a02d14de13134e77eb9cc787ac622791b38b74931d1588bb5750b06951c8c0"
      },
      {
        "id": "",
        "name": "6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99"
      },
      {
        "id": "",
        "name": "21d9ed48d51a5b5edae7eb7f99d1648a3ce7d419bc46234143c37dec4638c60d"
      },
      {
        "id": "",
        "name": "83b32b8cf59dbd718d04749fd05f78e9ac8efdb0ffec5dc219a010f124937e6a"
      },
      {
        "id": "",
        "name": "f34cfdc950124d26b4f2f99b192a4ab7a4163af3143c3b18bc2271ca08d6c899"
      },
      {
        "id": "",
        "name": "097f139304307375cd41bb2dc3913166e9f05f0d6bf5aad1efdc081dbf07c68d"
      },
      {
        "id": "",
        "name": "16474e9e4773fbc1e0b48a5025fad31b7f084b1beffb9a42687b4d01979885fe"
      },
      {
        "id": "",
        "name": "ee3e0a9f2b04ebd4badd04e2ce6d4b24a1d0811c1c51e86d147d38919ef8b90f"
      },
      {
        "id": "",
        "name": "5070ad8f45e6ee70e1b8a4fdbf78b2c823ca2c47a817fc29b5042b15880f92d9"
      },
      {
        "id": "",
        "name": "43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2"
      },
      {
        "id": "",
        "name": "b204d00dd01da0408978e4101479efbdc977e84ad4a99cdbfd4a3364df964dd0"
      },
      {
        "id": "",
        "name": "d1caa376cb45b6a1eb3a45c5633c5ef75f7466b8601ed72c8022a8b3f6c1f3be"
      },
      {
        "id": "",
        "name": "1192381230fce07ef3f2a86ce746c71f22a7e0b97eea7560a38337844e8f3041"
      },
      {
        "id": "",
        "name": "0e13ca9e55fbe5ae323f7f295dde8d68aaca3e2c737999174691bee77525de99"
      },
      {
        "id": "",
        "name": "85b8522ab6252a67c812bcfbe3adce392ce715b14cdeaf34d5102d3634d69433"
      },
      {
        "id": "",
        "name": "c96f1812e0a2d520e6e46e0ec6cd9ba8b5735c57847bea8634b017b7ed8dd8ce"
      },
      {
        "id": "",
        "name": "8cc335a675f86c691ae04f31b4098fc5761d4e41abfdcbdf3c1016c9e9440490"
      },
      {
        "id": "",
        "name": "705127c9730dcdebfa0f30103952107098d164d1941c400ea1f3ff454951c225"
      },
      {
        "id": "",
        "name": "082a6286953c0f4256751f1c9bf4c06d4c14fc63f601a78e2f70f7ebd42821cb"
      },
      {
        "id": "",
        "name": "b659389cde06f5e01e592dca458fe1be07a302c40dc2a820c7f76d4ee788bad3"
      },
      {
        "id": "",
        "name": "a07ddb6d55f122b056d594fd2efaadacdcb2eab6f65e6f0766684773300a7859"
      },
      {
        "id": "",
        "name": "5b7ee3d9f851363d4291689f9ac1a02e18ea024c7ab28009b032a60701639a5d"
      },
      {
        "id": "",
        "name": "28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3"
      },
      {
        "id": "",
        "name": "bc2b7627c5e02e5d8c6311955f1a5c09c62b511aba87b90e493c59c7d360c263"
      },
      {
        "id": "",
        "name": "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983"
      },
      {
        "id": "",
        "name": "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f"
      },
      {
        "id": "",
        "name": "66f9c0eb64db7fac127d3d6d2a5a65de6b00bf2b78146a5acecdba2c628b1753"
      },
      {
        "id": "",
        "name": "f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c"
      },
      {
        "id": "",
        "name": "b1444193923ca6f71c70c6a45011378ef00459c8a0795da6e1637ef74a24facb"
      },
      {
        "id": "",
        "name": "4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129"
      },
      {
        "id": "",
        "name": "ec90465dbe3e2846be394bc2d76ddffdee4834086bcc65a6f43535f51333a7d5"
      },
      {
        "id": "",
        "name": "ea1a0bb1bc5eb31b85675dc91370ee26a8bc6571b0c21a8fc5faa58e67fa01ac"
      },
      {
        "id": "",
        "name": "604f7aa77a14f07baa21e76b73ceb7970037bfbdcc2040bf2e445702e99587a0"
      },
      {
        "id": "",
        "name": "2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc"
      },
      {
        "id": "",
        "name": "966908e8863bb78cdd66d29f1d425578cdd2035b6045b86fd8418bfde5e34986"
      },
      {
        "id": "",
        "name": "dc3c1616b70ab3a8b9c25e46fa00f04e18364909ca7ed5b2698f58918e0ccef3"
      },
      {
        "id": "",
        "name": "72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6"
      },
      {
        "id": "",
        "name": "9422d19bca175bf0727336b6ed5bef01c81e5a80dfdaebf4d7cde9ebfb4ef44e"
      },
      {
        "id": "",
        "name": "dea7885448e9a75ab45bd0b08a01f548c37e7d012cd519c4b8a85941d359e26b"
      }
    ],
    "malware": [
      {
        "id": "82dff3ba-8577-40eb-9d30-4e498eb5c2f3",
        "name": "Tomb",
        "slug": "tomb"
      },
      {
        "id": "793460da-ff23-42e1-8356-8145b19df7cd",
        "name": "ModeloRAT",
        "slug": "modelorat"
      },
      {
        "id": "e5f01230-4eca-4233-ad8d-8cb847db86ec",
        "name": "Brave Prince - S0252",
        "slug": "brave-prince-s0252"
      },
      {
        "id": "d908f85b-23ab-437b-8806-bdda8a362b72",
        "name": "Latrodectus",
        "slug": "latrodectus"
      },
      {
        "id": "79a76b2c-a36e-4f7c-868d-d594bb83f587",
        "name": "NtlmThief",
        "slug": "ntlmthief"
      },
      {
        "id": "25c206e0-ce3f-45db-ac64-14247e93d44a",
        "name": "SystemBC",
        "slug": "systembc"
      },
      {
        "id": "1b6bedc0-e5e2-4fe1-b00e-37f877de45ad",
        "name": "InterlockRAT",
        "slug": "interlockrat"
      },
      {
        "id": "fa4b390a-4316-4dfc-85a2-37215649d6d7",
        "name": "Endico",
        "slug": "endico"
      },
      {
        "id": "c70c9980-18de-4208-93f5-0bd2dddeb40c",
        "name": "Sliver",
        "slug": "sliver"
      },
      {
        "id": "729568dd-945d-4ddd-a658-5bd09cdc772d",
        "name": "MintLoader",
        "slug": "mintloader"
      },
      {
        "id": "2c582ed8-35df-4ef9-917d-994e214aa5f9",
        "name": "Vidar",
        "slug": "vidar"
      },
      {
        "id": "7abfda8a-f00e-4217-89b8-ba0f1d9238fb",
        "name": "Gootloader",
        "slug": "gootloader"
      },
      {
        "id": "8a8a9d0c-d94f-4f49-a455-2c33c71c6009",
        "name": "NodeSnake",
        "slug": "nodesnake"
      },
      {
        "id": "ed067bb6-83d6-44e7-93fb-d5da383f81c6",
        "name": "JunkFiction",
        "slug": "junkfiction"
      },
      {
        "id": "74e799e4-b6c4-4671-bf75-3fc330306a6f",
        "name": "Plus Keylogger",
        "slug": "plus-keylogger"
      },
      {
        "id": "9ee1fc72-602f-444d-aff8-6c6f866b82a3",
        "name": "Mallard",
        "slug": "mallard"
      },
      {
        "id": "9dfb3520-9eed-4e3e-af09-cbe047ec535f",
        "name": "Supper",
        "slug": "supper"
      },
      {
        "id": "afa53b59-f1a7-4fea-927f-563d0d4214e8",
        "name": "Broomstick",
        "slug": "broomstick"
      },
      {
        "id": "04eb4a7b-2a00-4c3c-bb72-30f0b5244397",
        "name": "Dave",
        "slug": "dave"
      },
      {
        "id": "521823ae-c6f7-42a6-b643-24d535c7a04b",
        "name": "Rhysida",
        "slug": "rhysida"
      },
      {
        "id": "ac54ae14-a013-4f73-8b97-ac1ed354d2cf",
        "name": "Interlock",
        "slug": "interlock"
      },
      {
        "id": "34002f23-d541-4b47-a2f6-2e8f5dfcd152",
        "name": "Berserk Stealer",
        "slug": "berserk-stealer"
      },
      {
        "id": "c58b8795-c3fb-4a18-bbce-13c2ca23c9e7",
        "name": "SocGholish",
        "slug": "socgholish"
      },
      {
        "id": "0153fa9d-8a83-4425-987f-07fd2dc6c903",
        "name": "PortStarter",
        "slug": "portstarter"
      }
    ],
    "intrusion_sets": [
      {
        "id": "40476519-32de-471d-8baf-67dbddb1e358",
        "name": "Hive0163, Rhysida, Vanilla Tempest, TAG-124, ITG23",
        "slug": "hive0163-rhysida-vanilla-tempest-tag-124-itg23"
      }
    ],
    "attack_patterns": [
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9e6c4b38-f4e1-4b1f-b90a-222f881acbab",
        "name": "T1087.002"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "f1bb7823-4f4b-4565-b472-bf0cfca467b1",
        "name": "T1486"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "e46a9411-d2a1-47c9-8820-c7f818f4c0b5",
        "name": "T1203"
      },
      {
        "id": "a15721d2-76b1-4869-bd1f-819afb6e368d",
        "name": "T1482"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2023-36036"
      },
      {
        "id": "",
        "name": "CVE-2026-20131"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "United States of America"
      },
      {
        "id": "",
        "name": "Energy"
      },
      {
        "id": "",
        "name": "Agriculture"
      },
      {
        "id": "",
        "name": "Finance"
      },
      {
        "id": "",
        "name": "Education"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Telecommunications"
      },
      {
        "id": "",
        "name": "Hospitality"
      },
      {
        "id": "",
        "name": "Retail"
      },
      {
        "id": "",
        "name": "Technology"
      },
      {
        "id": "",
        "name": "Construction"
      },
      {
        "id": "",
        "name": "Media"
      },
      {
        "id": "",
        "name": "Aerospace"
      },
      {
        "id": "",
        "name": "NGO"
      },
      {
        "id": "",
        "name": "Chemical"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Healthcare"
      },
      {
        "id": "",
        "name": "Transportation"
      },
      {
        "id": "",
        "name": "Government"
      },
      {
        "id": "",
        "name": "scs-techresources.com"
      },
      {
        "id": "",
        "name": "repair-provision-supplies-folder.trycloudflare.com"
      },
      {
        "id": "",
        "name": "second.ms-updated-service.com"
      },
      {
        "id": "",
        "name": "nucleusgate.com"
      },
      {
        "id": "",
        "name": "year.giver-tuyk.org"
      },
      {
        "id": "",
        "name": "nimoloxanulokol.com"
      },
      {
        "id": "",
        "name": "locals.best-default-server.com"
      },
      {
        "id": "",
        "name": "utility-include-clubs-measurement.trycloudflare.com"
      },
      {
        "id": "",
        "name": "microsoft-teams.icu"
      },
      {
        "id": "",
        "name": "lamp-voters-biodiversity-phillips.trycloudflare.com"
      },
      {
        "id": "",
        "name": "secure.connecter-edge.com"
      },
      {
        "id": "",
        "name": "sos.konowe-sodo.com"
      },
      {
        "id": "",
        "name": "yum.deyno-xom.com"
      },
      {
        "id": "",
        "name": "firist.ms-updated-service.com"
      },
      {
        "id": "",
        "name": "meet-noted-tax-qualification.trycloudflare.com"
      },
      {
        "id": "",
        "name": "albany-motels-visibility-bus.trycloudflare.com"
      },
      {
        "id": "",
        "name": "updt-ms-srv.org"
      },
      {
        "id": "",
        "name": "auth-ms-service.site"
      },
      {
        "id": "",
        "name": "auth-ms-service.org"
      },
      {
        "id": "",
        "name": "maines.forever-size.com"
      },
      {
        "id": "",
        "name": "liabilities-complications-discussing-temporal.trycloudflare.com"
      },
      {
        "id": "",
        "name": "registrywave.com"
      },
      {
        "id": "",
        "name": "corner-teacher-guam-characterization.trycloudflare.com"
      },
      {
        "id": "",
        "name": "medhurstwaelcci.net"
      },
      {
        "id": "",
        "name": "first.best-default-server.com"
      },
      {
        "id": "",
        "name": "os-update-server.com"
      },
      {
        "id": "",
        "name": "leadslaw.com"
      },
      {
        "id": "",
        "name": "aaa.load-edge-service.com"
      },
      {
        "id": "",
        "name": "clouds.forever-size.com"
      },
      {
        "id": "",
        "name": "flowmiceornfidgring.cc"
      },
      {
        "id": "",
        "name": "no-global.qomaun-upd.com"
      },
      {
        "id": "",
        "name": "moore-cgi-pen-drove.trycloudflare.com"
      },
      {
        "id": "",
        "name": "os-update-server.live"
      },
      {
        "id": "",
        "name": "time.konowe-sodo.com"
      },
      {
        "id": "",
        "name": "rpm-chicken-during-staying.trycloudflare.com"
      },
      {
        "id": "",
        "name": "updt-ms-srv.com"
      },
      {
        "id": "",
        "name": "specials-storm-height-warriors.trycloudflare.com"
      },
      {
        "id": "",
        "name": "dex.nomok-xore.com"
      },
      {
        "id": "",
        "name": "nelavohomet.com"
      },
      {
        "id": "",
        "name": "tmp.alomo-pofo.org"
      },
      {
        "id": "",
        "name": "hire-household-squad-postcard.trycloudflare.com"
      },
      {
        "id": "",
        "name": "dpf.nomok-xore.com"
      },
      {
        "id": "",
        "name": "ms-sql-auth.com"
      },
      {
        "id": "",
        "name": "survivors-troops-interesting-learned.trycloudflare.com"
      },
      {
        "id": "",
        "name": "mails.alomo-pofo.org"
      },
      {
        "id": "",
        "name": "partyglacierhip.top"
      },
      {
        "id": "",
        "name": "os-update-server.top"
      },
      {
        "id": "",
        "name": "fix.connecter-edge.com"
      },
      {
        "id": "",
        "name": "os-update-server.org"
      },
      {
        "id": "",
        "name": "secured.best-default-server.org"
      },
      {
        "id": "",
        "name": "dev.konowe-sodo.com"
      },
      {
        "id": "",
        "name": "reduce-highest-acknowledge-apparent.trycloudflare.com"
      },
      {
        "id": "",
        "name": "default.ms-updated-service.com"
      },
      {
        "id": "",
        "name": "mail.load-edge-service.com"
      },
      {
        "id": "",
        "name": "carlo-payment-bullet-grocery.trycloudflare.com"
      },
      {
        "id": "",
        "name": "mail.best-default-server.site"
      },
      {
        "id": "",
        "name": "last.best-default-server.org"
      },
      {
        "id": "",
        "name": "updt-ms-srv.site"
      },
      {
        "id": "",
        "name": "johnny-republicans-muscles-partners.trycloudflare.com"
      },
      {
        "id": "",
        "name": "baseline-include-priority-bar.trycloudflare.com"
      },
      {
        "id": "",
        "name": "mailed.load-edge-service.com"
      },
      {
        "id": "",
        "name": "coretether.com"
      },
      {
        "id": "",
        "name": "donnellykilbakk.cc"
      },
      {
        "id": "",
        "name": "misc-elliott-mouth-leading.trycloudflare.com"
      },
      {
        "id": "",
        "name": "muscle-european-entering-bigger.trycloudflare.com"
      },
      {
        "id": "",
        "name": "country-character-how-charging.trycloudflare.com"
      },
      {
        "id": "",
        "name": "describe-absent-operational-seventh.trycloudflare.com"
      },
      {
        "id": "",
        "name": "eugene-examinations-contained-timber.trycloudflare.com"
      },
      {
        "id": "",
        "name": "apt.deyno-xom.com"
      },
      {
        "id": "",
        "name": "ssh.qomaun-upd.com"
      },
      {
        "id": "",
        "name": "bits-promotions-turned-editions.trycloudflare.com"
      },
      {
        "id": "",
        "name": "edinburgh-packaging-sense-idol.trycloudflare.com"
      },
      {
        "id": "",
        "name": "heap.best-default-server.site"
      },
      {
        "id": "",
        "name": "jane-practitioner-lightning-preservation.trycloudflare.com"
      },
      {
        "id": "",
        "name": "orearch.giver-tuyk.org"
      },
      {
        "id": "",
        "name": "kolinhumercianali.org"
      },
      {
        "id": "",
        "name": "postal-ssl-converted-quantity.trycloudflare.com"
      },
      {
        "id": "",
        "name": "browser-updater.com"
      },
      {
        "id": "",
        "name": "screenshots-executive-joins-hammer.trycloudflare.com"
      },
      {
        "id": "",
        "name": "liverpool-patterns-lanes-specified.trycloudflare.com"
      },
      {
        "id": "",
        "name": "confident-accounts-ban-damaged.trycloudflare.com"
      },
      {
        "id": "",
        "name": "browser-updater.live"
      },
      {
        "id": "",
        "name": "cigarette-assumed-biotechnology-checklist.trycloudflare.com"
      },
      {
        "id": "",
        "name": "coffee-lloyd-families-excluded.trycloudflare.com"
      },
      {
        "id": "",
        "name": "typically-performer-builds-increasing.trycloudflare.com"
      },
      {
        "id": "",
        "name": "status.connecter-edge.com"
      },
      {
        "id": "",
        "name": "updt-ms-srv.top"
      },
      {
        "id": "",
        "name": "glasgow-thank-del-heard.trycloudflare.com"
      }
    ]
  },
  "external_refs": [
    "https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem",
    "https://otx.alienvault.com/pulse/6a2c7a1d041f52879495ac3e"
  ]
}