{
  "name": "Operation STANDOFF: A Campaign Hiding C2 Behind GitHub Redirects",
  "slug": "operation-standoff-a-campaign-hiding-c2-behind-github-redirects",
  "description": "VMRay Labs uncovered a sophisticated Russian-speaking cybercriminal operation combining multiple attack vectors on shared infrastructure. The campaign distributes commodity stealers including Raccoon, RedLine, Amadey, SmokeLoader, Socelars, and Glupteba through a pay-per-install loader while enrolling victims into a proxy-botnet. Command-and-control servers on Russian provider TimeWeb use GitHub domain redirects for concealment. A custom multi-operator console called STANDOFF COORD coordinates hands-on-keyboard intrusions targeting Active Directory environments, storing NTLM hashes, Kerberos tickets, and credentials organized by network segments. Additionally, the infrastructure hosts an AI-driven influence operation using industrial-scale Telegram account farms and automated engagement platforms targeting Russian-speaking mobile gaming communities through a portal called Mobile Arena, driving traffic toward gambling sites and malware distribution.",
  "published": "2026-07-21T11:39:00.265000+00:00",
  "created_at": "2026-07-21T23:48:15.566000+00:00",
  "modified_at": null,
  "created_at_opencti": null,
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "active-directory-targeting",
    "ai-driven-influence",
    "amadey",
    "github-redirect-concealment",
    "glupteba",
    "pay-per-install",
    "proxy-botnet",
    "raccoon stealer",
    "redline",
    "russian-speaking",
    "smokeloader",
    "socelars",
    "telegram-account-farm",
    "timeweb-infrastructure",
    "xmrig"
  ],
  "tags": [],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "aa3ae014-e752-4213-a9ee-1132bd12109c",
        "name": "CVE-2021-34527"
      }
    ],
    "indicators": [
      {
        "id": "71535404-a0ce-4b39-bf28-ff645c6c77b1",
        "name": "rcacademy.at"
      },
      {
        "id": "4347fe97-773e-41ba-931b-37716d518600",
        "name": "185.247.185.85"
      },
      {
        "id": "b6d8fb0b-39c2-44e7-abbd-9265c65c1eb3",
        "name": "http://noc.social/@menaomi"
      },
      {
        "id": "d000ff0e-17c7-4e24-9b10-21646d29d059",
        "name": "cloudjah.com"
      },
      {
        "id": "7a9ec867-2002-4916-999c-7d5d0632ee4d",
        "name": "188.225.39.252"
      },
      {
        "id": "0f62236b-0b46-4d72-bdcd-22f4fbf0c3ec",
        "name": "russianhckers.online"
      },
      {
        "id": "37fde485-47c9-4452-a041-7f6854f4d599",
        "name": "www.wgqpw.com"
      },
      {
        "id": "0ecb364a-9001-4540-b78a-abe809a9c122",
        "name": "147.45.183.198"
      },
      {
        "id": "42476d6e-d71c-41db-a0cd-4fc12b7ce5b1",
        "name": "bull-drops.ru"
      },
      {
        "id": "b604fbcf-8649-4f78-9dd7-8e540a58ff98",
        "name": "http://185.215.113.35/d2VxjasuwS/index.php"
      },
      {
        "id": "3b32bae2-dc5d-490c-8544-85391cc91f16",
        "name": "46.149.70.18"
      },
      {
        "id": "c99ef37f-874d-4d31-9a96-332c459e6e97",
        "name": "http://www.xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "0f98f563-7152-493f-8299-8a21c1f14cc9",
        "name": "22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41"
      },
      {
        "id": "efdd9a22-d92e-42dd-89e4-feae0d7b5b5b",
        "name": "wfsdragon.ru"
      },
      {
        "id": "ea128662-f0f0-4e0c-bf1c-6366127f620d",
        "name": "mobilearena.online"
      },
      {
        "id": "e7b2fd91-60f8-4b5b-97f7-38762d1544b9",
        "name": "www.mobilearena.online"
      },
      {
        "id": "d03800d4-6c99-4358-a099-12709acefbdb",
        "name": "http://cloudjah.com/77_1.exe"
      },
      {
        "id": "75d4687d-9d95-42f3-9826-df6ea1a9cc95",
        "name": "all-mobile-pa1ments.com.mx"
      },
      {
        "id": "2e6feaad-3def-443f-a5ba-ad51af939ec1",
        "name": "http://wfsdragon.ru/api/setStats.php"
      },
      {
        "id": "cff376a2-986f-41ee-b2f5-38ff6c70469b",
        "name": "http://212.192.241.62/base/api/statistics.php"
      },
      {
        "id": "4c30187c-490a-4bed-96e1-7a0f0af3c149",
        "name": "ggstandoff.online"
      },
      {
        "id": "d8979901-5720-44cb-9323-c4108a4bb7dd",
        "name": "server5.trumops.com"
      },
      {
        "id": "79c1c08f-901e-451e-8af0-4ade3739dff6",
        "name": "http://bulldrops.ru"
      },
      {
        "id": "1a91d0ac-b95d-4b12-9a44-71667a7cad52",
        "name": "195.133.73.225"
      },
      {
        "id": "37c95731-9fff-415d-85fb-f76153209a41",
        "name": "http://n.data??[]"
      },
      {
        "id": "c21d49e4-0f27-42ce-bfa2-5e693ba36eb5",
        "name": "37.252.21.227"
      },
      {
        "id": "4f90ede6-de76-4218-a232-83c5b388d51d",
        "name": "194.87.131.30"
      },
      {
        "id": "3eea10b5-faba-4d4f-8b02-9a73f9531225",
        "name": "xn----9sbhgocsfmg4a1kfg.xn--p1ai"
      },
      {
        "id": "ed55214f-870f-42f2-b904-1390c53d3e06",
        "name": "bull-drops.online"
      },
      {
        "id": "1cae775a-b3f0-478b-be66-fa441b3c4470",
        "name": "92.51.22.34"
      },
      {
        "id": "c7a4cb96-ee29-4302-8342-db844ee29987",
        "name": "http://loopaai.ru"
      },
      {
        "id": "fca8b85a-a284-446c-ba00-b20d0ae321ce",
        "name": "https://212.193.30.29/assets/index-CxeLM22L.js"
      },
      {
        "id": "e9cc9135-bcd9-4b47-90af-51922627b5eb",
        "name": "loopaai.ru"
      },
      {
        "id": "c65cdcde-dde2-49db-99f2-ffb541036e03",
        "name": "bulldrops.online"
      },
      {
        "id": "269074ea-d274-4983-9a3c-da7935f37d8c",
        "name": "93.183.80.126"
      },
      {
        "id": "4ac1510d-9cd8-43be-a286-e573ae0ae6f0",
        "name": "www.xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "63ba023a-f8dc-4f00-8d7a-5fb43a6edaa6",
        "name": "http://www.loopaai.ru"
      },
      {
        "id": "54838961-e72c-444d-900e-2848b5e81d3f",
        "name": "212.60.21.249"
      },
      {
        "id": "1b524c44-a028-4f41-94bd-13b051e1119c",
        "name": "185.225.19.18"
      },
      {
        "id": "57015c56-524a-46b1-94ef-7db95497a514",
        "name": "buy-fantasy-football.com.sg"
      },
      {
        "id": "41a82a83-050a-4823-bf6d-5b0e0fff0a6e",
        "name": "217.198.13.211"
      },
      {
        "id": "e5020fe4-431c-454b-948e-5a86ea1d6fdb",
        "name": "bulldrops.ru"
      },
      {
        "id": "3199ecd4-2a78-42ba-b958-10bae1c67e40",
        "name": "http://xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "0991e15f-984b-4cf1-b677-81643c2900e7",
        "name": "89.223.71.207"
      },
      {
        "id": "2adaaf3e-fe8c-4e59-a8bd-5622b2117b8f",
        "name": "http://212.193.30.45/proxies.txt"
      },
      {
        "id": "804a4466-4e03-42ef-9ab4-df5e43904580",
        "name": "212.193.30.29"
      },
      {
        "id": "26453d44-b6e4-403d-8b33-a201a2d23c9e",
        "name": "zadrot.gg"
      },
      {
        "id": "2e2b8ca2-91a8-42fb-be8d-3a84d95d2755",
        "name": "api.russianhackers.online"
      },
      {
        "id": "fb3859b2-fcf2-4be4-a9c5-2df9fff65038",
        "name": "www.listincode.com"
      },
      {
        "id": "8f3b8b1f-680f-4e39-bcba-f9252ce7357d",
        "name": "212.192.241.62"
      },
      {
        "id": "3e7ea7f4-70a9-4007-a9a2-ce7f7ac06e04",
        "name": "russianhackers.online"
      },
      {
        "id": "ccb71501-67ef-4ee3-a444-955abec44605",
        "name": "https://api.russianhackers.online"
      },
      {
        "id": "fbe65578-1e6b-42ca-9da7-456bd0a9c1ef",
        "name": "147.45.237.23"
      },
      {
        "id": "a99554f4-d4c9-41cb-8f4c-a0f86049d3e6",
        "name": "listincode.com"
      },
      {
        "id": "e2d1fb06-5b62-413e-b3e8-484d58cb723a",
        "name": "www.xn----9sbhgocsfmg4a1kfg.xn--p1ai"
      },
      {
        "id": "19f64007-5f70-410c-96e7-00e57d98a0a4",
        "name": "185.215.113.35"
      },
      {
        "id": "116823f0-258d-47c6-a3aa-46fb76fe96d8",
        "name": "45.139.78.67"
      },
      {
        "id": "e6f047cd-e767-40d2-b399-f7168152f106",
        "name": "188.225.72.157"
      },
      {
        "id": "4f5aa5ee-967e-4132-a16b-eb47e1211c13",
        "name": "new-androidapps.me"
      },
      {
        "id": "644d85f4-46a1-4927-bb4c-46d543b9270e",
        "name": "5.129.196.85"
      },
      {
        "id": "a4c3d217-a932-4b09-9eda-9c781b26d709",
        "name": "topniemannpickshop.cc"
      },
      {
        "id": "a7c561bc-7726-484b-bdaf-b27b45cd727e",
        "name": "influencesite.ru"
      },
      {
        "id": "31ec104b-e5bf-4daf-ade2-0255b33b51ea",
        "name": "gginfluence.influencesite.ru"
      },
      {
        "id": "7aa6d9b4-87a6-40db-8795-fbb55bcf72e2",
        "name": "194.87.56.156"
      },
      {
        "id": "bb6b7a4d-c946-4a8a-9a3e-a54dcb5555b8",
        "name": "http://rcacademy.at/upload/"
      },
      {
        "id": "c65e5d45-336f-4d0f-84a1-385e37f39d86",
        "name": "185.215.113.44"
      },
      {
        "id": "aa28b124-fc10-42d9-ba2d-d622985374cc",
        "name": "188.225.82.125"
      },
      {
        "id": "f14e4ce2-8687-4e84-8669-0981950619f3",
        "name": "90.156.224.57"
      },
      {
        "id": "cdf327f0-605b-4272-ae32-e353b9299577",
        "name": "www.loopaai.ru"
      },
      {
        "id": "bb1c2439-63ab-4670-b4f3-9436f510aa06",
        "name": "buy-fantasy-gxmes.com.sg"
      },
      {
        "id": "8ab3fb51-80f7-445a-a4dd-076c0e52075a",
        "name": "xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "8bc0a03b-b08a-4bc2-89be-5387cd655e65",
        "name": "212.193.30.45"
      }
    ],
    "intrusion_sets": [
      {
        "id": "23cae440-6295-4bb2-8e7c-a9d6c24d582b",
        "name": "Operation STANDOFF",
        "slug": "operation-standoff"
      }
    ],
    "attack_patterns": [
      {
        "id": "6ccd4566-e15e-40cf-b7df-4a3f737ce5cd",
        "name": "T1036.005"
      },
      {
        "id": "cf746a02-00ea-419e-912d-7b03f969c491",
        "name": "T1518.001"
      },
      {
        "id": "93b2c4dd-5523-4464-8976-78754ee372fd",
        "name": "T1012"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "7dc1bc79-ccad-419e-b7c0-0f7fa8522270",
        "name": "T1055.012"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "e615d5ec-8d67-4048-b21d-a5fb09925bb9",
        "name": "T1552.001"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "5d4ae945-eb29-4b3b-aa69-bc32dc769878",
        "name": "T1558"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "9f21708c-24b6-46b5-bf7e-522256e8470c",
        "name": "T1552.004"
      },
      {
        "id": "97d377d8-89c7-48f8-a79f-0f48bd60df74",
        "name": "T1005"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e6c0ca23-78ee-4b0e-96fa-e80efab3665d",
        "name": "T1003.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "c998d878-b668-40dd-a84c-9ca7f73caaa4",
        "name": "T1497.003"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "7e5fbc10-b908-4ce8-8ba8-9fd70790c6ae",
        "name": "T1562.004"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "13e4e609-d2b4-4f52-9082-bb1514dba7e3",
        "name": "Raccoon Stealer",
        "slug": "raccoon-stealer"
      },
      {
        "id": "3b14bdfd-fdea-4534-96f8-2a0bd99b3833",
        "name": "Amadey - S1025",
        "slug": "amadey-s1025"
      },
      {
        "id": "9f5ac497-cb00-4732-9d01-49a96069bc30",
        "name": "RedLine",
        "slug": "redline"
      },
      {
        "id": "80caa2b9-f143-4b08-badc-fb0e3a1cf62c",
        "name": "Glupteba",
        "slug": "glupteba"
      },
      {
        "id": "18cdcd02-9b8a-4679-af0f-ae675f4d8043",
        "name": "Socelars",
        "slug": "socelars"
      },
      {
        "id": "f8f32f39-7be0-41b8-8758-e913d3bd5f92",
        "name": "XMRig",
        "slug": "xmrig"
      },
      {
        "id": "c565a1bc-b917-4e4b-9106-e41ccbbece44",
        "name": "SmokeLoader",
        "slug": "smokeloader"
      }
    ],
    "observables": [
      {
        "id": "e0b19736-23a5-435e-b7ea-0744252824ab",
        "name": "mobilearena.online"
      },
      {
        "id": "9b751d2e-389c-48a6-9137-023daa531e35",
        "name": "influencesite.ru"
      },
      {
        "id": "3175d74e-546b-4487-ae0b-2b6589e32499",
        "name": "bulldrops.ru"
      },
      {
        "id": "e8d068f8-123a-411e-99f7-4f359bec03d1",
        "name": "xn----9sbhgocsfmg4a1kfg.xn--p1ai"
      },
      {
        "id": "f1cbaff4-e217-4d43-83a1-fdf843d95684",
        "name": "cloudjah.com"
      },
      {
        "id": "1ac6972d-1451-4250-991a-3302da4d0777",
        "name": "russianhckers.online"
      },
      {
        "id": "c9d13c19-5de6-4087-a95f-8937fa095feb",
        "name": "all-mobile-pa1ments.com.mx"
      },
      {
        "id": "b9d5bf09-678b-46ee-8f78-1bc3d8a9c5e6",
        "name": "rcacademy.at"
      },
      {
        "id": "e5328ed6-c2cc-44e2-9b5d-d8cd52d7c93d",
        "name": "wfsdragon.ru"
      },
      {
        "id": "28c66b6f-4aa4-4952-a5b8-2915a233ad6d",
        "name": "ggstandoff.online"
      },
      {
        "id": "9b603fe8-590d-4dd0-9a17-1efe4cbe56a4",
        "name": "bull-drops.ru"
      },
      {
        "id": "53401e8b-81b8-41bc-83e3-8c5b61947843",
        "name": "buy-fantasy-football.com.sg"
      },
      {
        "id": "c2408188-3833-4856-813b-fb694e08818f",
        "name": "bulldrops.online"
      },
      {
        "id": "161542c4-3c87-4eec-8b44-ec2b117e9475",
        "name": "xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "ab1e37ea-ef73-4922-9691-cd9365898cbe",
        "name": "russianhackers.online"
      },
      {
        "id": "230ada78-dcc9-46a7-accb-c4d18794c38e",
        "name": "listincode.com"
      },
      {
        "id": "d0b6e31e-b7cc-4b9d-b4cd-864b0ab822c2",
        "name": "buy-fantasy-gxmes.com.sg"
      },
      {
        "id": "36d2874a-710a-44b7-a695-98a4b4437351",
        "name": "loopaai.ru"
      },
      {
        "id": "19e816f9-33f9-4383-bb99-3d54f24b9f77",
        "name": "new-androidapps.me"
      },
      {
        "id": "23217a62-9d96-42f0-90c8-da9828114335",
        "name": "topniemannpickshop.cc"
      },
      {
        "id": "84b0a66d-0c52-48f8-a481-731a3a635769",
        "name": "bull-drops.online"
      },
      {
        "id": "de2217b1-6a27-4871-93cb-8d5f03393ee4",
        "name": "zadrot.gg"
      },
      {
        "id": "bcdf9dcc-df7a-4556-bab6-b8105479c5ee",
        "name": "server5.trumops.com"
      },
      {
        "id": "f292159f-f020-485c-9e1b-cd0670c2dd46",
        "name": "www.mobilearena.online"
      },
      {
        "id": "75f6934a-b3b0-4b72-900a-7e46352272e3",
        "name": "www.xn----9sbhgocsfmg4a1kfg.xn--p1ai"
      },
      {
        "id": "ecbbab66-3313-4b07-985f-9834ae63d205",
        "name": "www.listincode.com"
      },
      {
        "id": "b6ea9b43-53c8-4b30-8332-e05cb5252353",
        "name": "gginfluence.influencesite.ru"
      },
      {
        "id": "e2e505ee-ab4c-4d9d-8c62-bb1f938bdd05",
        "name": "www.wgqpw.com"
      },
      {
        "id": "3a44d145-2566-464b-9102-bfca0d3bf689",
        "name": "www.xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "45878812-e3a6-48f2-81a4-6f42543a5c15",
        "name": "www.loopaai.ru"
      },
      {
        "id": "b422a5cd-f3cc-456d-bab4-d07741e13148",
        "name": "api.russianhackers.online"
      },
      {
        "id": "3eee1c21-5e09-4125-b336-1af70521e33c",
        "name": "5.129.196.85"
      },
      {
        "id": "0d17cec1-4119-44b7-9c86-fcbe5d65af50",
        "name": "212.60.21.249"
      },
      {
        "id": "136522c2-0e4b-42b7-8991-8e1a1b537b6f",
        "name": "92.51.22.34"
      },
      {
        "id": "ffd090be-d271-49f6-9adb-bc57b2bc4de9",
        "name": "93.183.80.126"
      },
      {
        "id": "13104f01-0f29-456f-8fcc-c29e2be79d51",
        "name": "194.87.131.30"
      },
      {
        "id": "7e4405c1-8ea0-475e-a117-270086361509",
        "name": "188.225.72.157"
      },
      {
        "id": "6167365b-f69b-4b48-9c48-46c46af46c51",
        "name": "212.193.30.29"
      },
      {
        "id": "870ef590-8a90-44a1-bcf3-6b918d2febb3",
        "name": "217.198.13.211"
      },
      {
        "id": "00e08237-63d7-4ade-9626-6c8bb37e00ed",
        "name": "212.192.241.62"
      },
      {
        "id": "ef12b9e3-ab32-4dde-93b0-44207cf06356",
        "name": "212.193.30.45"
      },
      {
        "id": "e89026f0-720c-46a0-86d6-feea7316d7aa",
        "name": "46.149.70.18"
      },
      {
        "id": "c1259f4d-f46e-4a74-a321-160a41ea2914",
        "name": "89.223.71.207"
      },
      {
        "id": "3cdd687a-8fc7-411a-9ece-9e1266d5f7be",
        "name": "147.45.237.23"
      },
      {
        "id": "45415d47-df84-47d2-813a-26a4cd346bee",
        "name": "90.156.224.57"
      },
      {
        "id": "f5a8ac66-48c2-49c8-a7d0-8172258325de",
        "name": "185.225.19.18"
      },
      {
        "id": "4e40e4be-4724-4c6f-895c-c42ff8c15c88",
        "name": "185.215.113.44"
      },
      {
        "id": "1d404115-f359-4335-a41b-f9184ec93ac5",
        "name": "194.87.56.156"
      },
      {
        "id": "969d7955-7c26-4350-879d-ef590aa62484",
        "name": "188.225.82.125"
      },
      {
        "id": "02d205ad-d10e-4e67-9874-7e74098b9487",
        "name": "37.252.21.227"
      },
      {
        "id": "969debfe-a23f-41eb-bff2-0db38824edef",
        "name": "147.45.183.198"
      },
      {
        "id": "ca9de618-8432-4b34-8d1a-dd16413a1035",
        "name": "188.225.39.252"
      },
      {
        "id": "e199a511-3600-42e8-ac95-96fc8d6093e9",
        "name": "185.247.185.85"
      },
      {
        "id": "d77f085a-17c3-4504-ac73-14dd9fc16ab1",
        "name": "45.139.78.67"
      },
      {
        "id": "9b352313-82e0-44af-ba3b-0ac87596492e",
        "name": "195.133.73.225"
      },
      {
        "id": "5b4ae582-643e-4830-81d6-e30f3ccc5f41",
        "name": "185.215.113.35"
      },
      {
        "id": "03c3618e-b53c-4a71-9b9b-604156b529d6",
        "name": "http://www.xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "a0e5c2d0-6c46-456b-9bee-29322866c251",
        "name": "https://api.russianhackers.online"
      },
      {
        "id": "89b83c43-5c59-423e-91e5-213141b396b0",
        "name": "http://wfsdragon.ru/api/setStats.php"
      },
      {
        "id": "e10ec94d-156d-4059-9bf8-a7a51294ecc2",
        "name": "http://185.215.113.35/d2VxjasuwS/index.php"
      },
      {
        "id": "0101e5bc-eaf1-4799-b65f-8c167fa1dffd",
        "name": "http://loopaai.ru"
      },
      {
        "id": "21a9302f-41f2-46c6-80f0-4ea011a4d9b3",
        "name": "http://xn--90aguaqgfu.xn--p1ai"
      },
      {
        "id": "e08c6214-95c6-4fa3-b9b7-518f74cc1bb1",
        "name": "http://212.192.241.62/base/api/statistics.php"
      },
      {
        "id": "fd4d7c06-0585-4ec5-a49b-929e42c729cc",
        "name": "http://rcacademy.at/upload/"
      },
      {
        "id": "a19ca297-0fe8-40aa-ae74-89a26b2896a9",
        "name": "http://bulldrops.ru"
      },
      {
        "id": "444bf62b-3d62-4b56-8d21-db97a5841e05",
        "name": "https://212.193.30.29/assets/index-CxeLM22L.js"
      },
      {
        "id": "88ba0169-0f18-46ed-a78e-23b492213bf1",
        "name": "http://www.loopaai.ru"
      },
      {
        "id": "4c4262a2-291d-41de-a315-3d5d0b378cbe",
        "name": "http://cloudjah.com/77_1.exe"
      },
      {
        "id": "1187a9cc-27c6-4839-85b0-b223b40fb9c3",
        "name": "http://212.193.30.45/proxies.txt"
      },
      {
        "id": "155d4361-9002-4822-befd-8da6ee550211",
        "name": "http://noc.social/@menaomi"
      },
      {
        "id": "6269b7d3-406f-448b-8787-7f750bf6494b",
        "name": "http://n.data??[]"
      }
    ]
  },
  "external_refs": [
    {
      "id": "fb479f43-767a-40bb-9a8b-3bdffbc6e2bf",
      "standard_id": "external-reference--13dd4a28-1f21-5cdd-8d56-4b6be9e2789d",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a5f5a54ab92617993537c0b",
      "hash": null,
      "external_id": "6a5f5a54ab92617993537c0b",
      "created": "2026-07-21T23:48:08.515Z",
      "modified": "2026-07-21T23:48:08.515Z",
      "createdById": null
    },
    {
      "id": "8d6b5a7c-f1b1-48c3-84cf-784a9f7e182e",
      "standard_id": "external-reference--a18eb984-5413-58dc-bf81-67686d52c263",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-21T23:48:08.599Z",
      "modified": "2026-07-21T23:48:08.599Z",
      "createdById": null
    }
  ]
}