{
  "name": "Unfurling Hemlock: Threat group uses cluster bomb campaigns",
  "slug": "unfurling-hemlock-threat-group-uses-cluster-bomb-campaigns",
  "description": "A threat actor dubbed Unfurling Hemlock has been observed distributing hundreds of thousands of malware samples in a campaign lasting several months. The malware is distributed using a 'cluster bomb' technique where each sample contains multiple stages of nested executable files, each containing additional malware payloads. The distributed malware includes stealers like Redline, RisePro, and Mystic Stealer, as well as loaders like Amadey and SmokeLoader. The campaign appears financially motivated and targets victims globally with no specific industry focus. The actor is suspected to be Eastern European based on language artifacts and hosting infrastructure.",
  "published": "2024-07-01T08:54:44+00:00",
  "created_at": "2024-07-01T08:54:44+00:00",
  "modified_at": "2024-07-01T09:17:48+00:00",
  "created_at_opencti": "2024-07-01T08:54:44+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-01",
    "amadey",
    "cluster bomb",
    "eastern european",
    "mass distribution",
    "mystic stealer",
    "redline",
    "risepro",
    "smokeloader",
    "stealers"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "77.91.124.86"
      },
      {
        "id": "",
        "name": "77.91.124.20"
      },
      {
        "id": "",
        "name": "77.91.124.1"
      },
      {
        "id": "",
        "name": "5.42.92.93"
      },
      {
        "id": "",
        "name": "31.192.237.75"
      },
      {
        "id": "",
        "name": "194.169.175.235"
      },
      {
        "id": "",
        "name": "195.123.218.98"
      },
      {
        "id": "",
        "name": "193.233.255.73"
      },
      {
        "id": "",
        "name": "193.233.132.12"
      },
      {
        "id": "",
        "name": "185.46.46.146"
      },
      {
        "id": "",
        "name": "185.172.128.79"
      },
      {
        "id": "",
        "name": "176.113.115.145"
      },
      {
        "id": "",
        "name": "109.107.182.45"
      },
      {
        "id": "",
        "name": "89.23.100.93"
      },
      {
        "id": "",
        "name": "185.161.248.142"
      },
      {
        "id": "",
        "name": "109.107.182.3"
      },
      {
        "id": "",
        "name": "77.91.68.29"
      },
      {
        "id": "",
        "name": "77.91.68.21"
      },
      {
        "id": "",
        "name": "77.91.124.130"
      },
      {
        "id": "",
        "name": "185.215.113.68"
      },
      {
        "id": "",
        "name": "http://globalsystemperu.com/forms/gate4.exe"
      },
      {
        "id": "",
        "name": "http://77.91.124.1/theme/index.php"
      },
      {
        "id": "",
        "name": "http://77.91.124.20/store/games/index.php"
      },
      {
        "id": "",
        "name": "http://77.91.68.29/fks/"
      },
      {
        "id": "",
        "name": "http://193.233.255.73/loghub/master"
      },
      {
        "id": "",
        "name": "http://185.46.46.146/none/vah50.exe"
      },
      {
        "id": "",
        "name": "http://185.215.113.68/theme/index.php"
      },
      {
        "id": "",
        "name": "http://109.107.182.45/red/line.exe"
      },
      {
        "id": "",
        "name": "http://109.107.182.3/some/love.exe"
      },
      {
        "id": "",
        "name": "http://109.107.182.3/love/bongo.exe"
      },
      {
        "id": "",
        "name": "http://77.91.68.21/nova/foxi.exe"
      },
      {
        "id": "",
        "name": "http://77.91.124.130/gallery/photo_570.exe"
      },
      {
        "id": "",
        "name": "http://5.42.92.93/i/smo.exe"
      },
      {
        "id": "",
        "name": "http://5.42.92.93/39902/from.exe"
      },
      {
        "id": "",
        "name": "host-file-host8.com"
      },
      {
        "id": "",
        "name": "host-file-host6.com"
      },
      {
        "id": "",
        "name": "globalsystemperu.com"
      },
      {
        "id": "",
        "name": "fd7a9b8e52e2fbcb090d5f5046a73d6e42b421abf063083210889f3fcb47dee0"
      },
      {
        "id": "",
        "name": "edfb4374d5c586f0690c95ff8cacb36bda6fb4743f20dda5e6f17e7e241edd47"
      },
      {
        "id": "",
        "name": "da4f614c983fa226d813de390937389ae4d1e043dd86524aa7a5246fd587826b"
      },
      {
        "id": "",
        "name": "be25926929b1aae0257d7f7614dd5ad637b8fd8e139c68f4d717e3dc9913e3cf"
      },
      {
        "id": "",
        "name": "94115d0eae0422b6605f0f25841c29b7cc6c029472a983b21d1cedcd7fdcd647"
      },
      {
        "id": "",
        "name": "8fe4d34a6a245c5acd3d1741213c1dd195468089b1a3fe80adfa6d8d8c94f2d8"
      },
      {
        "id": "",
        "name": "80df101f1f93fa53b3dcbc315d3ec5d8c8330c08b5622ac3207f746d016b66dc"
      },
      {
        "id": "",
        "name": "7f101603fbb2821504cf2c71fca0450689dfcd6d1f36e57e27f0392be0f2d1dd"
      },
      {
        "id": "",
        "name": "7d18c67c13ec919f3950092319d11eda129c8498e171612e681eebf1c977493d"
      },
      {
        "id": "",
        "name": "65923603a6f117c7460b8cc69009105208bdfa544b90446580915db8fe127ae8"
      },
      {
        "id": "",
        "name": "5697652d0fd5b4a05ac00f6ec028fd3dc3e34ed7b112c4b8c6048eae72a8d326"
      },
      {
        "id": "",
        "name": "35c55b402e770e25adf57ffbd408a428af9ce21a735474b5d94ccdd4123e68f8"
      },
      {
        "id": "",
        "name": "301a1c9f4e82fc8f57577ea399a2591557ff57d337472c3f8482a89c5b4105d5"
      },
      {
        "id": "",
        "name": "1f224093b9557dd73caaf1c6a823028c286ddd3414bceb0860e0fe084fb8c2ab"
      },
      {
        "id": "",
        "name": "0ef7459cebfe9bd9102c5eccc16eedddec5931e69bf705aa44aa3c7af584f209"
      },
      {
        "id": "",
        "name": "0c48529d2979698341e89d6ea5f7e9211fa277e40d3f6a55a8996135944ebdad"
      },
      {
        "id": "",
        "name": "37b9e74da5fe5e27aaedc25e4aac7678553b6d7d89ec4d99e8b9d0627dcbdc12"
      },
      {
        "id": "",
        "name": "229e859dda6cc0bc99a395824f4524693bdd0292b4b9c55d06b4fa38279b3ea2"
      }
    ],
    "malware": [
      {
        "id": "7b9bd884-f95c-41e4-a6ea-d11bb6f01e11",
        "name": "Mystic Stealer",
        "slug": "mystic-stealer"
      },
      {
        "id": "3b14bdfd-fdea-4534-96f8-2a0bd99b3833",
        "name": "Amadey - S1025",
        "slug": "amadey-s1025"
      },
      {
        "id": "c565a1bc-b917-4e4b-9106-e41ccbbece44",
        "name": "SmokeLoader",
        "slug": "smokeloader"
      },
      {
        "id": "9f5ac497-cb00-4732-9d01-49a96069bc30",
        "name": "Redline",
        "slug": "redline"
      },
      {
        "id": "1b6618e3-112c-4eae-9302-67b8ebb7afa2",
        "name": "RisePro",
        "slug": "risepro"
      }
    ],
    "intrusion_sets": [
      {
        "id": "0779c1e8-2bb7-4f58-ac15-4a76251a0bee",
        "name": "Unfurling Hemlock",
        "slug": "unfurling-hemlock"
      }
    ],
    "attack_patterns": [
      {
        "id": "6c54bb5e-b90c-478e-b1fb-705daf1869b3",
        "name": "T1197"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "af9ed2e3-4663-4723-beab-c606ddc312e0",
        "name": "T1543"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://outpost24.com/blog/unfurling-hemlock-cluster-bomb-campaign/",
    "https://otx.alienvault.com/pulse/66828af454bc977c19ec8c74"
  ]
}