{
  "name": "Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access",
  "slug": "photo-zip-campaign-targeting-hospitality-industry-delivers-nodejs-implant-for-persistent-access",
  "description": "Since April 2026, a sophisticated multi-stage intrusion campaign has targeted hospitality and hotel organizations across Europe and Asia. The operation uses photo-themed ZIP archives containing malicious shortcut files disguised as images. When executed, these shortcuts initiate an attack chain involving obfuscated PowerShell, Node.js-based implants, and dual registry persistence mechanisms. The threat actor exploits legitimate services like Calendly and Google redirects for phishing delivery, employing authentication laundering to bypass email security controls. The campaign evolved through two waves, introducing .NET DLL compilation, Cloudflare-fronted infrastructure, and refined obfuscation techniques. Post-compromise activities include command-and-control beaconing over non-standard ports, forced shutdowns, and portable executable compilation, suggesting preparation for additional malicious operations.",
  "published": "2026-06-26T03:57:11.688000+00:00",
  "created_at": "2026-06-26T08:41:43.549000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-26T08:41:43.549000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "authentication laundering",
    "purerat",
    "tonrat",
    "wacatac"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "c79b572d-c61b-4185-b9e4-ad2cb2204e35",
        "name": "178.16.54.27"
      },
      {
        "id": "d57641fd-d9ca-482b-aa6d-fedc9133c2e9",
        "name": "visaphoto-secure.info"
      },
      {
        "id": "76e575fc-5f79-4bce-906b-5c4c53e45d4e",
        "name": "9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2"
      },
      {
        "id": "734e8817-9632-4e9d-8e53-b63d263f3036",
        "name": "photo-26654.cfd"
      },
      {
        "id": "aa13b9c8-93b0-4409-b991-317cb2c987ad",
        "name": "safe-picvault.info"
      },
      {
        "id": "934fa569-07d8-4255-9e81-aa4f4c6d9f7c",
        "name": "recallnine.info"
      },
      {
        "id": "e2d6c2a8-2e44-4e4a-8887-757bb4e8ceea",
        "name": "doc-imagehub.info"
      },
      {
        "id": "c8a1d031-db73-434f-bf1d-b6edf378a20d",
        "name": "97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f"
      },
      {
        "id": "ec9836c9-5e0d-412c-a37b-44b92cb2dd99",
        "name": "safephoto-vault.info"
      },
      {
        "id": "a17f0d83-620f-4a5f-9112-65eb380827b7",
        "name": "89934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c1028"
      },
      {
        "id": "c435a9ee-b10f-49b4-992f-66e81a9897f7",
        "name": "1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd"
      },
      {
        "id": "593d9e55-abb5-4472-b096-4a7224ecceaa",
        "name": "63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae"
      },
      {
        "id": "d917effc-992c-4f9a-840a-ae1d4359ead8",
        "name": "deeprace.info"
      },
      {
        "id": "dcce2a45-f17f-4c07-9d9e-317faf103c31",
        "name": "photobookadm.pro"
      },
      {
        "id": "b8ce8405-aa98-4cfd-9e0a-992b3f2a1891",
        "name": "docshub-secure.com"
      },
      {
        "id": "39a3d815-10a3-4da8-9408-7a4485543c28",
        "name": "photo-7216302.sbs"
      },
      {
        "id": "e60627bd-1b4c-4263-a6d3-3f11c302a06d",
        "name": "83e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b7"
      },
      {
        "id": "33bdaa56-ff78-4f0e-9816-6b2a1da13ec8",
        "name": "racestrech.info"
      },
      {
        "id": "013d7012-e135-49f9-a7d6-5fee13385c2e",
        "name": "kiptownim.info"
      },
      {
        "id": "69d2be1e-95e7-4201-97cd-6494407e02c5",
        "name": "b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea"
      },
      {
        "id": "c13f824a-34bf-40ae-b570-d2a6cc4eae16",
        "name": "193.202.84.32"
      },
      {
        "id": "5da3a666-9cc5-4696-8dbd-2508aa18d5c6",
        "name": "docshub-01.info"
      },
      {
        "id": "44b7cf29-02d9-4a12-8763-951198ff5555",
        "name": "recepyman.info"
      },
      {
        "id": "a469ca2f-fbbc-449e-81e4-01361f698244",
        "name": "imagevault-safe.info"
      },
      {
        "id": "af50ddfd-e39f-4800-9ce8-f49ad523cb85",
        "name": "reservebookphot.pro"
      },
      {
        "id": "46b12931-878e-444a-be71-587b200e67af",
        "name": "safedocphoto.info"
      },
      {
        "id": "2c3ce4b6-a427-4602-a020-281e061a7fa9",
        "name": "photo-7216102.click"
      },
      {
        "id": "374ecb9c-9fe3-4af9-951c-a875c5ae137d",
        "name": "recstrace.info"
      },
      {
        "id": "91ff8520-a03d-44c5-8f59-37fd83705fb1",
        "name": "ginrinsou.com"
      },
      {
        "id": "6c6bba3d-efc5-4ac2-a543-6dec74b18b37",
        "name": "da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291c"
      },
      {
        "id": "77a5f754-a582-4945-a0f0-1090b90ae814",
        "name": "visaimage-storage.icu"
      },
      {
        "id": "0438c79f-2231-4012-bbf4-3eaaad4e58a7",
        "name": "secure-imagehub.info"
      },
      {
        "id": "813c275d-36e6-4b14-a399-fcb356d962ae",
        "name": "fairyspells.info"
      },
      {
        "id": "8669843b-f1c3-441d-9b68-6c0f13d8dd18",
        "name": "safevault-hub.info"
      },
      {
        "id": "0ebd05ba-afee-4e2e-9e66-957750f3f928",
        "name": "bd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9"
      },
      {
        "id": "b21ac479-54b8-457e-80a8-1274f9c24a09",
        "name": "06a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e227969"
      },
      {
        "id": "6586ce5b-6d26-46bf-9440-fcedf6ecde19",
        "name": "derbyoni.info"
      },
      {
        "id": "0cc77a88-5a56-4a40-aabf-2ead16cdfc9a",
        "name": "kelopins.info"
      },
      {
        "id": "bb6e2744-7126-427c-9b1f-264c50990110",
        "name": "joincroud.info"
      },
      {
        "id": "7a4a041e-f35b-4f2a-9b79-45726c57af27",
        "name": "montagelips.info"
      },
      {
        "id": "2e19fcdd-9dc1-4d61-b43a-6dd17c2f9117",
        "name": "bookreservphoto.pro"
      },
      {
        "id": "077a6b39-7072-47f0-9bbd-2a5a1d2306ed",
        "name": "3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b44"
      },
      {
        "id": "ea6dd5dc-39ae-4dc5-a286-5ba4d2106a49",
        "name": "photosafe-hub.info"
      },
      {
        "id": "ffa9232c-a639-454f-8cf0-0d7b679a2930",
        "name": "photo-hub-io.info"
      },
      {
        "id": "1353142f-f661-4238-a00a-f6bf1723936d",
        "name": "heliosup.info"
      },
      {
        "id": "19e56ae0-e512-49e4-9a14-835e0595f681",
        "name": "2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc"
      },
      {
        "id": "5f6e7c2b-1df9-4ecd-b05c-dbc24a7d0a36",
        "name": "f629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14"
      },
      {
        "id": "2d8f6f44-23f1-44ca-b683-d918e34be9f3",
        "name": "kentjerk.info"
      },
      {
        "id": "dcc05eb3-1bdd-4c3f-9ff7-e70873046423",
        "name": "6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca9"
      },
      {
        "id": "91b44630-724d-48f2-b602-b3051578b349",
        "name": "178.16.55.179"
      },
      {
        "id": "65c925d9-6394-4c31-9951-97ea97bd3aae",
        "name": "vertualstreak.info"
      },
      {
        "id": "cd61a10d-fac4-4851-98fb-21d4a641a50f",
        "name": "49cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd"
      },
      {
        "id": "8971cbb9-1c09-4584-87f0-88a0885e03af",
        "name": "photo-dekor.xyz"
      },
      {
        "id": "5deb9147-f7c2-45af-85c8-3b3afb8920c8",
        "name": "higoksbupwou.com"
      },
      {
        "id": "959135ab-e8f7-46ec-857b-197b783d2155",
        "name": "dashgamein.info"
      },
      {
        "id": "d43b95d1-b768-487c-8f94-e9052043715a",
        "name": "tripadvisor-photo-view.com"
      },
      {
        "id": "b5d68e04-ec00-4629-8c5f-286c57d04965",
        "name": "sec-safe-dc.info"
      },
      {
        "id": "c5c8123d-5024-4a57-93a2-2158ffbf8988",
        "name": "snapkeep.info"
      },
      {
        "id": "aee90704-e6a6-4c73-87f2-bcaf51a890ae",
        "name": "photo-26254.cfd"
      },
      {
        "id": "32e77dff-a325-4ef4-b22f-fc875000ecd9",
        "name": "prejointl.info"
      },
      {
        "id": "64b5626f-c519-42a3-9ae1-12cf9d317f7a",
        "name": "photo-27857.cfd"
      },
      {
        "id": "98adbbf8-d83d-4929-9590-bcc4f0d8d542",
        "name": "photo-26653.cfd"
      },
      {
        "id": "86e2956c-f614-4f97-9336-06be9b8f4b89",
        "name": "kellystreets.info"
      },
      {
        "id": "97541c45-458d-4ed7-b7f5-9ee96895b0d2",
        "name": "photo-8632454.cfd"
      },
      {
        "id": "e5ef9570-ddb7-428d-95d1-a715c98921d2",
        "name": "c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5"
      },
      {
        "id": "4c347364-7998-4c32-a1b7-4c6a14e13403",
        "name": "haobbao.com"
      },
      {
        "id": "c3be3ada-517e-431c-aa48-b3dc5e5364a7",
        "name": "1c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a"
      },
      {
        "id": "c6934185-4fe7-4e47-ac70-a93595a44b7b",
        "name": "04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1"
      },
      {
        "id": "c64f1032-2ce3-4265-95c2-aa66b276f8b8",
        "name": "photodoc-secure.info"
      },
      {
        "id": "96ae7cbd-7f8e-48a6-a613-e529963f05d5",
        "name": "aluminiostramuntana.com"
      },
      {
        "id": "4bb953e6-dee8-4ea4-b02e-609677e88d5f",
        "name": "safedoc-storage.info"
      },
      {
        "id": "0df274eb-21d4-4511-b576-d7e7ff1b08b5",
        "name": "dancamp.info"
      },
      {
        "id": "22129a11-1ee8-4005-b823-0d070efc5d48",
        "name": "visa-vault.info"
      },
      {
        "id": "fdfadb60-ca21-49c4-8a1c-f0073cfd0a18",
        "name": "photo-132454.cfd"
      },
      {
        "id": "9f3738b8-e2e5-4e25-9e03-30624c242d75",
        "name": "lestresot.info"
      },
      {
        "id": "273d0a5c-cae9-4ec8-b4d0-585fc17994f9",
        "name": "zloapobikahy23.bond"
      },
      {
        "id": "82a81045-b307-4e54-94e9-dd4e88d2e2c7",
        "name": "photo-21473.xyz"
      },
      {
        "id": "eb8d07d3-4ed0-4630-807d-fd53b11be9d6",
        "name": "keypmenu.info"
      },
      {
        "id": "00af3eff-b276-4479-960e-77b49442dca5",
        "name": "hakeiwjs727wj.com"
      },
      {
        "id": "a9d6e40b-5b33-430a-8188-851712641fcf",
        "name": "photobook-reserv.pro"
      },
      {
        "id": "76229df1-db2a-4f78-95d6-21e45a7596d3",
        "name": "ministrew.info"
      },
      {
        "id": "d6d37b89-3d53-4dbe-9e97-a11e0f8ca5aa",
        "name": "visaimages.info"
      },
      {
        "id": "e3811db8-5052-4a02-a037-2758cf093ea7",
        "name": "lookinlip.info"
      },
      {
        "id": "d5316f14-53c3-4a30-829f-98cdc84d5c00",
        "name": "imagestore-hub.info"
      },
      {
        "id": "8803689f-16ac-4038-8956-a148194fa800",
        "name": "kinghoruswe.info"
      },
      {
        "id": "47d61d17-f0c8-436c-bd4a-dcabff5a0820",
        "name": "visa-safedocs.info"
      },
      {
        "id": "40135cb2-0f38-4356-a289-f9fabfeab7fe",
        "name": "expedla-getphoto.cloud"
      },
      {
        "id": "9358e288-1d7c-4a9a-a660-8c8419c1882e",
        "name": "image-vlt.info"
      },
      {
        "id": "21c4f871-8b81-424b-8dc0-638d5415b949",
        "name": "visaphoto-vault.info"
      },
      {
        "id": "4763cf62-2d49-4bf7-ba74-fda098899242",
        "name": "docstore-safe.info"
      },
      {
        "id": "0d5088b5-9906-475a-b00a-f6b90b8f5352",
        "name": "98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c8"
      },
      {
        "id": "6215d31b-503c-4396-a61d-5bfed1c5aabc",
        "name": "photo-26656.cfd"
      },
      {
        "id": "49f740e1-b577-445e-8575-08406172ea60",
        "name": "finallyrain.info"
      },
      {
        "id": "4cd79f12-ce0f-416b-86bb-97cb68288fc4",
        "name": "photo-box.info"
      },
      {
        "id": "78f5f333-eb5f-4ede-834b-05a631ca806c",
        "name": "safedoc-vault.info"
      },
      {
        "id": "0ad0605c-ca97-4c6a-9061-51baeb4975cb",
        "name": "widjssij728dj.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "79525d9e-3824-4347-a471-7dcea20fd864",
        "name": "T1583.006"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "6a8eba2e-51b0-4b6e-a733-a581dcbf4806",
        "name": "T1027.004"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "03b1ce63-5c00-48de-90c1-7996e7785bb7",
        "name": "T1584.006"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "8598a502-2b24-4c8a-8ec3-45179f49e5b7",
        "name": "T1199"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "d19f56ca-5ce8-4bd1-af90-7d83e394470c",
        "name": "T1583.001"
      }
    ],
    "malware": [
      {
        "id": "dc5de256-86ef-4c55-9e07-0e105e12cd1d",
        "name": "Wacatac",
        "slug": "wacatac"
      },
      {
        "id": "b20facc3-d109-4596-b143-91f7803faba3",
        "name": "PureRat",
        "slug": "purerat"
      },
      {
        "id": "66507518-fe9d-49c1-a614-3148fb933119",
        "name": "TonRAT",
        "slug": "tonrat"
      }
    ],
    "observables": [
      {
        "id": "2abab78f-2963-4423-90c5-86f11bb24b24",
        "name": "safedocphoto.info"
      },
      {
        "id": "ee35a0c3-d6fc-4ef2-afec-e337b3cbc2a2",
        "name": "docstore-safe.info"
      },
      {
        "id": "64d10b8c-a00e-438f-af99-ea2be3f77458",
        "name": "deeprace.info"
      },
      {
        "id": "6c3d56cc-8b28-437a-a889-c3834c276f24",
        "name": "visaimage-storage.icu"
      },
      {
        "id": "b52e06fe-2233-4e97-8fba-3de667381aad",
        "name": "photo-26654.cfd"
      },
      {
        "id": "9088a458-f80f-4b64-8aa5-73b0a8e82df6",
        "name": "vertualstreak.info"
      },
      {
        "id": "001a45d8-b8ea-43b0-b99a-6daefc5b8c89",
        "name": "lestresot.info"
      },
      {
        "id": "2bb2a555-a96f-4046-91f2-377f0a39a106",
        "name": "photo-8632454.cfd"
      },
      {
        "id": "2de8e6b6-68ff-45f4-8b05-49634b9f7102",
        "name": "visaimages.info"
      },
      {
        "id": "eff15682-44bc-4d25-bca9-4ff328bb46ad",
        "name": "racestrech.info"
      },
      {
        "id": "adddb642-0e6d-4af9-b267-5d7556598570",
        "name": "visaphoto-vault.info"
      },
      {
        "id": "ccaeabd3-7f0c-4c2d-83d0-15620e45b0e7",
        "name": "expedla-getphoto.cloud"
      },
      {
        "id": "9d57a109-031d-4871-b809-43856f82234f",
        "name": "joincroud.info"
      },
      {
        "id": "fb0e841f-70a3-45ec-8975-3e299b6de6cb",
        "name": "aluminiostramuntana.com"
      },
      {
        "id": "bfe3f105-888f-4cac-94fe-75d6eed3bef0",
        "name": "widjssij728dj.com"
      },
      {
        "id": "bcd899c5-54f9-41b5-99cd-1e465c2dcbac",
        "name": "imagestore-hub.info"
      },
      {
        "id": "08751767-b3d8-47b0-8982-ad6f8cd09e58",
        "name": "photo-26254.cfd"
      },
      {
        "id": "93a65829-2aa0-4acc-bd72-978b1b6eeaf4",
        "name": "safe-picvault.info"
      },
      {
        "id": "689eda24-906b-4d0f-a55d-cba0a62ac0e0",
        "name": "zloapobikahy23.bond"
      },
      {
        "id": "a449bbff-80d3-425a-bcd6-976755b714eb",
        "name": "photo-26656.cfd"
      },
      {
        "id": "e46884c8-566f-4415-81c3-c62f1b0afc7b",
        "name": "recallnine.info"
      },
      {
        "id": "6326caab-ac51-4654-ada2-17a78a22749a",
        "name": "kiptownim.info"
      },
      {
        "id": "055416fe-bd30-4dc2-8352-076b2f6ed6ed",
        "name": "photo-27857.cfd"
      },
      {
        "id": "1cdfe9bb-46ef-4e16-8685-77f69dc867c5",
        "name": "fairyspells.info"
      },
      {
        "id": "694633e0-9fa1-4cc3-b9a4-4f33972b2951",
        "name": "visa-safedocs.info"
      },
      {
        "id": "31903094-a3e8-42f5-839c-5719f1e121fa",
        "name": "recstrace.info"
      },
      {
        "id": "4e12e084-b3fe-4fb2-be2c-581c619cbc87",
        "name": "photodoc-secure.info"
      },
      {
        "id": "81ed2fa1-f4de-4adf-bc9d-fd5f0bf970ec",
        "name": "photobook-reserv.pro"
      },
      {
        "id": "57ce69ad-64bd-45bc-a0c5-a79416d3a0c0",
        "name": "photo-box.info"
      },
      {
        "id": "8dd8228b-5cb2-48bc-9164-611e939ec506",
        "name": "photobookadm.pro"
      },
      {
        "id": "d5573dde-d6cc-4d96-a0df-d2a5408bdf30",
        "name": "finallyrain.info"
      },
      {
        "id": "29c7cdce-1957-4f13-b477-c0def3a47d40",
        "name": "prejointl.info"
      },
      {
        "id": "2ef6ac9d-3edf-44f3-b59e-8804cbeedb0e",
        "name": "kentjerk.info"
      },
      {
        "id": "66686a76-bbf2-4e53-92da-82070f30539c",
        "name": "recepyman.info"
      },
      {
        "id": "6b4c5c02-2334-408b-a19a-23c558f3927a",
        "name": "ministrew.info"
      },
      {
        "id": "b2ddf8d1-4dd9-4be4-b403-ecf40358cda1",
        "name": "bookreservphoto.pro"
      },
      {
        "id": "3ae255e7-cd29-43b0-af11-1832290f23bd",
        "name": "safedoc-vault.info"
      },
      {
        "id": "a6fe6fb5-a1a0-46eb-ad6c-849771f9bad4",
        "name": "visaphoto-secure.info"
      },
      {
        "id": "ee274f82-e044-43eb-8ea2-7a9ef2e0ee81",
        "name": "heliosup.info"
      },
      {
        "id": "5e2a94ea-b30f-4ccf-a866-4b3e704fc41d",
        "name": "photo-26653.cfd"
      },
      {
        "id": "e38e8db0-d2b1-4974-8dbe-ceb0bac29368",
        "name": "kinghoruswe.info"
      },
      {
        "id": "359ab920-049d-4edb-b860-300e85fbb5a5",
        "name": "image-vlt.info"
      },
      {
        "id": "ac22a221-c4ef-4883-8221-98b9aa324376",
        "name": "secure-imagehub.info"
      },
      {
        "id": "9ff77fe0-3144-41c1-9bf1-00ba1659ab55",
        "name": "montagelips.info"
      },
      {
        "id": "6f1493ce-da1d-4a13-ab54-6cb5dfd2ba8c",
        "name": "docshub-secure.com"
      },
      {
        "id": "2e2985af-0405-4ec0-a7a6-655f9ba91b40",
        "name": "photo-7216302.sbs"
      },
      {
        "id": "21cf7316-cf02-4188-b9e1-33da2b6858d5",
        "name": "derbyoni.info"
      },
      {
        "id": "55c89682-7b95-4e91-8c20-18b53edcf099",
        "name": "dancamp.info"
      },
      {
        "id": "e1b325a5-c1f6-4288-99aa-40d864517b50",
        "name": "photosafe-hub.info"
      },
      {
        "id": "622c6019-73a8-45a7-b749-8c49fb28258c",
        "name": "kellystreets.info"
      },
      {
        "id": "7cdb7100-1029-4052-9663-fe6740db5656",
        "name": "keypmenu.info"
      },
      {
        "id": "528985bc-ab88-4c36-97d4-7e9213f3225b",
        "name": "safedoc-storage.info"
      },
      {
        "id": "6fc1b881-2c05-46e5-be97-2cf7a01bb137",
        "name": "safephoto-vault.info"
      },
      {
        "id": "ef8b7784-e9f5-4b71-a8cc-0b84a018d6af",
        "name": "photo-7216102.click"
      },
      {
        "id": "95fbdccd-0e07-458d-a0db-0c1e5abf0cbc",
        "name": "snapkeep.info"
      },
      {
        "id": "09d8406e-bb55-4256-9802-70aa96864613",
        "name": "photo-132454.cfd"
      },
      {
        "id": "49b84311-54d5-4167-9334-f1105e60244e",
        "name": "sec-safe-dc.info"
      },
      {
        "id": "003df841-8145-4ae3-ae18-90fb2930ae63",
        "name": "higoksbupwou.com"
      },
      {
        "id": "aa752ae1-14d3-4fdf-b9d8-8f67164405b9",
        "name": "photo-dekor.xyz"
      },
      {
        "id": "7096e677-85ec-4a24-bb51-ccfbf23716b7",
        "name": "doc-imagehub.info"
      },
      {
        "id": "7a2e190d-aca5-46e0-8f5c-07bd13fadda3",
        "name": "photo-hub-io.info"
      },
      {
        "id": "d1c2d0e0-d8ea-496b-bcac-29dca15449fe",
        "name": "haobbao.com"
      },
      {
        "id": "90464c6a-459b-4563-a9f6-defbd8f225e6",
        "name": "safevault-hub.info"
      },
      {
        "id": "f0aa8691-4dbf-4a51-b69a-216d83afe7f5",
        "name": "visa-vault.info"
      },
      {
        "id": "a44a5b5c-01cf-4e12-872f-ed2e23f63701",
        "name": "ginrinsou.com"
      },
      {
        "id": "d469ed23-f933-49f6-8ca9-7b9267d95ff5",
        "name": "hakeiwjs727wj.com"
      },
      {
        "id": "b9593369-8fd5-4496-9a05-2551898a20bc",
        "name": "docshub-01.info"
      },
      {
        "id": "cc1c6355-cebf-403e-9051-1ad96be94f06",
        "name": "tripadvisor-photo-view.com"
      },
      {
        "id": "776c2253-bcba-4755-bd64-51cac1fd88ea",
        "name": "reservebookphot.pro"
      },
      {
        "id": "683a97bd-12c2-4706-b2b4-1c3e2360ae94",
        "name": "photo-21473.xyz"
      },
      {
        "id": "e19e2ee1-d88f-468c-873f-dc6165e9a07f",
        "name": "kelopins.info"
      },
      {
        "id": "09f70976-eb4b-4018-b076-650710b38081",
        "name": "lookinlip.info"
      },
      {
        "id": "df2bd284-998b-493e-ab95-5d745de63018",
        "name": "imagevault-safe.info"
      },
      {
        "id": "3a1a1312-81b4-4c61-ba8d-51de015de432",
        "name": "dashgamein.info"
      },
      {
        "id": "5859b250-dca2-48c3-bd9c-6f3f5a71091e",
        "name": "178.16.55.179"
      },
      {
        "id": "f38aed4e-fa2c-4294-9ba9-30763f401cf2",
        "name": "193.202.84.32"
      },
      {
        "id": "f1fd92dc-7b6e-4f96-ad8d-a2eb35476494",
        "name": "178.16.54.27"
      }
    ]
  },
  "external_refs": [
    {
      "id": "6e2ecc84-a384-44b0-af62-9f70b93f2a49",
      "standard_id": "external-reference--75add7eb-34b4-526e-ad99-04c5be6986e5",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/",
      "hash": null,
      "external_id": null,
      "created": "2026-06-26T08:41:41.941Z",
      "modified": "2026-06-26T08:41:41.941Z",
      "createdById": null
    },
    {
      "id": "4d873b66-e384-4ba2-acfb-6cefa52c9eb8",
      "standard_id": "external-reference--c0635c11-3151-51c7-82fd-1d2b073569bd",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3df8979895cc716bfbf931",
      "hash": null,
      "external_id": "6a3df8979895cc716bfbf931",
      "created": "2026-06-26T08:41:41.906Z",
      "modified": "2026-06-26T08:41:41.906Z",
      "createdById": null
    }
  ]
}