{ "spec": "The Hunters Ledger STIX 2.1 bundle manifest: poll this file, compare sha256 per bundle, fetch what changed.", "license": "CC BY 4.0", "count": 43, "zip": { "file": "hunters-ledger-stix-bundles.zip", "url": "https://the-hunters-ledger.com/stix/hunters-ledger-stix-bundles.zip", "sha256": "a6cf8e8ac2f6613568c2eac95f5452ba720544348560bef4d23633a969c2a161", "bytes": 1897949 }, "bundles": [ { "slug": "newdouble-clickfix", "title": "FACEIT ClickFix Pages Point CS2 Players to a Script URL That VirusTotal Ties to a Steam-Focused Executable", "date": "2026-09-28", "file": "newdouble-clickfix.json", "url": "https://the-hunters-ledger.com/stix/newdouble-clickfix.json", "report_url": "https://the-hunters-ledger.com/reports/newdouble-clickfix/", "bundle_id": "bundle--080292e0-21f4-46b1-bf29-2e884de0f9ec", "report_id": "report--851e8bde-d374-5746-9390-ba1a54c91f64", "sha256": "6fbe670bb39d1b97656fe48c85c49775e490873bac7c390526d39ca460ca09ee", "bytes": 33390, "objects": 27, "indicators": 14, "modified": "2026-10-09T13:20:06.431403Z" }, { "slug": "gotenberg-rce-cryptomining-107-175-69-137", "title": "Gotenberg CVE-2026-42589 Mass Exploitation and Cryptomining", "date": "2026-09-16", "file": "gotenberg-rce-cryptomining-107-175-69-137.json", "url": "https://the-hunters-ledger.com/stix/gotenberg-rce-cryptomining-107-175-69-137.json", "report_url": "https://the-hunters-ledger.com/reports/gotenberg-rce-cryptomining-107-175-69-137/", "bundle_id": "bundle--19c94c88-5a81-4113-85ab-44a49ce6fad6", "report_id": "report--7963499f-e9ec-5e0b-848a-8473bdffa3d2", "sha256": "c39dcd1167f10ad9d69e998c0e569f78a38408e4378f7829a134237431d659e7", "bytes": 31153, "objects": 22, "indicators": 11, "modified": "2026-10-09T13:20:05.685047Z" }, { "slug": "sliver-c2-windows-postex-staging-193-233-202-17", "title": "Sliver C2 Windows Post-Exploitation Staging, 193.233.202.17", "date": "2026-09-07", "file": "sliver-c2-windows-postex-staging-193-233-202-17.json", "url": "https://the-hunters-ledger.com/stix/sliver-c2-windows-postex-staging-193-233-202-17.json", "report_url": "https://the-hunters-ledger.com/reports/sliver-c2-windows-postex-staging-193-233-202-17/", "bundle_id": "bundle--7236e113-2ae8-4d17-b011-5a98b351d3b1", "report_id": "report--9f175132-e498-5e02-9c9c-b1ab5dff72db", "sha256": "4144d9d3a88d6dcec41ed34521b81189afe54a478eaf3039a8c5f43bb351076d", "bytes": 3682024, "objects": 4918, "indicators": 101, "modified": "2026-10-09T13:20:12.880315Z" }, { "slug": "opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817", "title": "Carrier Credential Harvesting Through a Customer's Router", "date": "2026-08-18", "file": "opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817.json", "url": "https://the-hunters-ledger.com/stix/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817.json", "report_url": "https://the-hunters-ledger.com/reports/opendirectory-13-140-145-210-weblogic-deserialization-telecom-harvester-20260817/", "bundle_id": "bundle--6e093c2c-583a-4a5b-80b4-5bce359ae295", "report_id": "report--2aa3b7a4-9d57-5059-94af-58ae5009f969", "sha256": "eb79f1f403a7b4a02cc3e6a03ba595443c51d6c77bb9820c3bd2d51461027cbe", "bytes": 3090372, "objects": 4085, "indicators": 105, "modified": "2026-10-09T13:20:07.381081Z" }, { "slug": "seasia-gov-exploitation-toolkit-144-172-106-236", "title": "The Middle Tier: A Non-APT Operator's Reach Into Four Southeast Asian Governments", "date": "2026-08-13", "file": "seasia-gov-exploitation-toolkit-144-172-106-236.json", "url": "https://the-hunters-ledger.com/stix/seasia-gov-exploitation-toolkit-144-172-106-236.json", "report_url": "https://the-hunters-ledger.com/reports/seasia-gov-exploitation-toolkit-144-172-106-236/", "bundle_id": "bundle--56efb779-5ba9-490e-92e8-b0cd86133753", "report_id": "report--24bb536a-5f81-59ee-b0a6-69371772c782", "sha256": "c7da7c8e796eab0bbf5d3324d900a8bf2a3748c487ab0ef6bdebc18caea8f339", "bytes": 175226, "objects": 191, "indicators": 30, "modified": "2026-10-09T13:20:12.474342Z" }, { "slug": "cloudsync-assembler-toolkit-91-197-98-188", "title": "CloudSync: An Assembler's Intrusion Toolkit", "date": "2026-08-03", "file": "cloudsync-assembler-toolkit-91-197-98-188.json", "url": "https://the-hunters-ledger.com/stix/cloudsync-assembler-toolkit-91-197-98-188.json", "report_url": "https://the-hunters-ledger.com/reports/cloudsync-assembler-toolkit-91-197-98-188/", "bundle_id": "bundle--e6ce9fc0-19d3-42ec-ad11-eca9ac3a6f1d", "report_id": "report--9e9a2d1e-2840-51a5-af43-b5ef11a64213", "sha256": "fb2859e161b9499423c6cac1105a30ea30fa5cb9b00378dcd1e03d2033512dab", "bytes": 185844, "objects": 205, "indicators": 34, "modified": "2026-10-09T13:20:04.180375Z" }, { "slug": "gocloud-multiservice-cryptojacking-149-28-112-221", "title": "GOCLOUD Multi-Service Cryptojacking", "date": "2026-07-26", "file": "gocloud-multiservice-cryptojacking-149-28-112-221.json", "url": "https://the-hunters-ledger.com/stix/gocloud-multiservice-cryptojacking-149-28-112-221.json", "report_url": "https://the-hunters-ledger.com/reports/gocloud-multiservice-cryptojacking-149-28-112-221/", "bundle_id": "bundle--29185711-8715-4cf1-b919-58a23a46893b", "report_id": "report--f600aa39-9356-5b94-8a65-4b8d27c6ba2e", "sha256": "2ea0ebcecc62e49e92537654d9e4ece7e703343e915ef2d291290ce0395b022a", "bytes": 182710, "objects": 239, "indicators": 38, "modified": "2026-10-09T13:20:05.511727Z" }, { "slug": "multivector-ecommerce-rce-toolkit-192-3-1-116", "title": "Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign", "date": "2026-07-21", "file": "multivector-ecommerce-rce-toolkit-192-3-1-116.json", "url": "https://the-hunters-ledger.com/stix/multivector-ecommerce-rce-toolkit-192-3-1-116.json", "report_url": "https://the-hunters-ledger.com/reports/multivector-ecommerce-rce-toolkit-192-3-1-116/", "bundle_id": "bundle--700f29e1-b8cb-4187-980e-4e5e5753cf3c", "report_id": "report--d2cbc7b4-0c74-5743-bbb9-91e98e6c514c", "sha256": "000f9fbe6aa93352e77f3d7daca1d0013d811176daaaf6d2aa3c3795fe5801c0", "bytes": 95417, "objects": 77, "indicators": 29, "modified": "2026-10-09T13:20:06.172203Z" }, { "slug": "evilsoul-engine-stealer-maas-144-172-103-98", "title": "EvilSoul-Engine: A Brazilian Stealer-Builder Malware-as-a-Service", "date": "2026-07-03", "file": "evilsoul-engine-stealer-maas-144-172-103-98.json", "url": "https://the-hunters-ledger.com/stix/evilsoul-engine-stealer-maas-144-172-103-98.json", "report_url": "https://the-hunters-ledger.com/reports/evilsoul-engine-stealer-maas-144-172-103-98/", "bundle_id": "bundle--8d84f2c8-dbb9-4387-a069-80180cddf209", "report_id": "report--a9f4eae3-2bc4-5503-9477-2a7eaafb1dbf", "sha256": "548a5ed4ee4e1831c5bd8afbcc178c9be4f635f24b30b0a518700eab28721490", "bytes": 365336, "objects": 472, "indicators": 46, "modified": "2026-10-01T19:54:13.201415Z" }, { "slug": "kaido-quasar-rat-144-172-109-203", "title": "KAIDO: A Brazilian Quasar-Fork RAT with Hidden-Desktop Session Hijacking", "date": "2026-07-03", "file": "kaido-quasar-rat-144-172-109-203.json", "url": "https://the-hunters-ledger.com/stix/kaido-quasar-rat-144-172-109-203.json", "report_url": "https://the-hunters-ledger.com/reports/kaido-quasar-rat-144-172-109-203/", "bundle_id": "bundle--a36dc265-9d00-4b7c-ad5d-4d481fb18dde", "report_id": "report--caeb4af1-7cfb-51f1-9401-c7268353f962", "sha256": "edfbf7f8f8e6b47b3f707162bc4a29b6db5a63ea144be279e5e822026c7c54d0", "bytes": 48505, "objects": 53, "indicators": 17, "modified": "2026-10-09T13:20:05.981711Z" }, { "slug": "ai-agent-frameworks-2026-05-23", "title": "Multi-Actor AI-Agent Framework Abuse (8 Operators)", "date": "2026-06-16", "file": "ai-agent-frameworks-2026-05-23.json", "url": "https://the-hunters-ledger.com/stix/ai-agent-frameworks-2026-05-23.json", "report_url": "https://the-hunters-ledger.com/reports/ai-agent-frameworks-2026-05-23/", "bundle_id": "bundle--aaf99332-4ac3-42bd-a4a3-7638d03e70bc", "report_id": "report--b0d9cd2f-d73f-5e19-a193-66cc1aa0e090", "sha256": "d1aa4c9a4fc128dd671c86e31915f4ef6df825e8cd294b21a192af3b279741b0", "bytes": 1675294, "objects": 2189, "indicators": 92, "modified": "2026-10-01T19:54:11.796449Z" }, { "slug": "flaskc2-postex-toolkit-67-215-232-25", "title": "Flask C2 & MSSQL CLR Backdoor on a Windows Post-Exploitation Staging Host", "date": "2026-06-12", "file": "flaskc2-postex-toolkit-67-215-232-25.json", "url": "https://the-hunters-ledger.com/stix/flaskc2-postex-toolkit-67-215-232-25.json", "report_url": "https://the-hunters-ledger.com/reports/flaskc2-postex-toolkit-67-215-232-25/", "bundle_id": "bundle--557e219a-8f40-4d1a-8397-01c08ef9df10", "report_id": "report--d334d776-c26a-566a-89b7-e513db9b7882", "sha256": "f69ad0a9b342a0da5fcabe571dd9bbe689e64c6701ffeb22ffc2fba893422ecc", "bytes": 254204, "objects": 327, "indicators": 20, "modified": "2026-10-09T13:20:04.805522Z" }, { "slug": "korean-claude-openclaw-221.150.15.104", "title": "Korean Claude Code + OpenClaw Operator (221.150.15.104)", "date": "2026-05-27", "file": "korean-claude-openclaw-221.150.15.104.json", "url": "https://the-hunters-ledger.com/stix/korean-claude-openclaw-221.150.15.104.json", "report_url": "https://the-hunters-ledger.com/reports/korean-claude-openclaw-221.150.15.104/", "bundle_id": "bundle--1e01c0bd-f667-4c6f-b0e4-531311d5e659", "report_id": "report--076f15c9-d73d-5228-95a2-ee80898c22b8", "sha256": "8d7922675398500b4a5ff19a87120fe615a670cc022d62897d3782fa0bb905ed", "bytes": 26456, "objects": 22, "indicators": 12, "modified": "2026-09-19T20:27:57.1734Z" }, { "slug": "rovodev-mirai-matrix-c2-87.106.143.220", "title": "Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)", "date": "2026-05-26", "file": "rovodev-mirai-matrix-c2-87.106.143.220.json", "url": "https://the-hunters-ledger.com/stix/rovodev-mirai-matrix-c2-87.106.143.220.json", "report_url": "https://the-hunters-ledger.com/reports/rovodev-mirai-matrix-c2-87.106.143.220/", "bundle_id": "bundle--b5f0f71d-f0bc-4f14-b2c7-ddf3a2f4f341", "report_id": "report--d6a3df6a-be77-50bd-8c19-3b3a9455ec93", "sha256": "dcd4589c35e084e60f620d2b423fffac7deaff171b71afb9301ac6fb9c1d64bc", "bytes": 1207210, "objects": 1549, "indicators": 61, "modified": "2026-10-09T13:20:11.325765Z" }, { "slug": "ghost-cryptojacker-vova75rus-77.110.96.200", "title": "GHOST Cryptojacker Kit — Vova75Rus Supply Chain (77.110.96.200)", "date": "2026-05-25", "file": "ghost-cryptojacker-vova75rus-77.110.96.200.json", "url": "https://the-hunters-ledger.com/stix/ghost-cryptojacker-vova75rus-77.110.96.200.json", "report_url": "https://the-hunters-ledger.com/reports/ghost-cryptojacker-vova75rus-77.110.96.200/", "bundle_id": "bundle--01f3c4de-e49a-4bee-aed3-b9346d3f250f", "report_id": "report--9aa555ca-d9d6-51c3-8af0-af351596d438", "sha256": "1ef66abbfe94d8ef19c8a2a425a75081e344af067a4f3e024d2524ae7362374a", "bytes": 605974, "objects": 754, "indicators": 56, "modified": "2026-10-01T19:54:13.787945Z" }, { "slug": "russian-gemini-credential-mill-213.165.51.115", "title": "Russian Gemini CLI Credential Mill (213.165.51.115)", "date": "2026-05-25", "file": "russian-gemini-credential-mill-213.165.51.115.json", "url": "https://the-hunters-ledger.com/stix/russian-gemini-credential-mill-213.165.51.115.json", "report_url": "https://the-hunters-ledger.com/reports/russian-gemini-credential-mill-213.165.51.115/", "bundle_id": "bundle--f906138e-6850-4e42-974d-fab62168ed64", "report_id": "report--a827f1aa-9f5c-538f-89b0-fe00bfc685e7", "sha256": "90da3294d3e923c71bcfec83f1069079a139eb25d7d75f6322d72f094127e760", "bytes": 365774, "objects": 442, "indicators": 41, "modified": "2026-10-01T19:54:19.824279Z" }, { "slug": "turkish-arpa-openclaw-state-insurer-209.38.205.158", "title": "Turkish ARPA AI-Augmented Observability Compromise (209.38.205.158)", "date": "2026-05-25", "file": "turkish-arpa-openclaw-state-insurer-209.38.205.158.json", "url": "https://the-hunters-ledger.com/stix/turkish-arpa-openclaw-state-insurer-209.38.205.158.json", "report_url": "https://the-hunters-ledger.com/reports/turkish-arpa-openclaw-state-insurer-209.38.205.158/", "bundle_id": "bundle--4c1b912b-5178-4da9-a3a2-246e1a0ff47c", "report_id": "report--aed547b6-648b-561d-b984-464d52e75bcc", "sha256": "3180d21bd32cfe26a88d8a1b17c8f37b9ee95c446f17c4b8f16f8792c95fcc58", "bytes": 140506, "objects": 137, "indicators": 42, "modified": "2026-10-09T13:20:15.51476Z" }, { "slug": "opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517", "title": "CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)", "date": "2026-05-17", "file": "opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517.json", "url": "https://the-hunters-ledger.com/stix/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517.json", "report_url": "https://the-hunters-ledger.com/reports/opendirectory-216-126-227-49-cve-2026-41940-cpanel-harvester-20260517/", "bundle_id": "bundle--3bb36528-f1c4-4f64-b959-d53f609afd95", "report_id": "report--5270d6b2-a916-5d6d-a909-1e8f4252dc72", "sha256": "b0e29a21269d1202a4900368f6def3f8adb730031c09d0caadc731a16bc16827", "bytes": 327766, "objects": 455, "indicators": 57, "modified": "2026-10-01T19:54:17.830457Z" }, { "slug": "bellamain-turkish-phaas-79-137-192-3-20260516", "title": "BellaMain Turkish PhaaS Panel (79.137.192.3)", "date": "2026-05-16", "file": "bellamain-turkish-phaas-79-137-192-3-20260516.json", "url": "https://the-hunters-ledger.com/stix/bellamain-turkish-phaas-79-137-192-3-20260516.json", "report_url": "https://the-hunters-ledger.com/reports/bellamain-turkish-phaas-79-137-192-3-20260516/", "bundle_id": "bundle--e13a585d-dc24-48fb-9c26-eaffd7dfcd12", "report_id": "report--ffb8d174-a8c9-5fc5-b94f-9462fdff65b3", "sha256": "cda1a4920304afbeeb8cd89c9cc30b3c80edf9dc8bc36475be7731fcb90bdab3", "bytes": 306853, "objects": 388, "indicators": 24, "modified": "2026-10-09T13:20:03.909348Z" }, { "slug": "inkognito-russian-vpn-phishing-185-221-196-118-20260516", "title": "Inkognito Russian VPN/Phishing Operator (INK VPN / INK Lens)", "date": "2026-05-16", "file": "inkognito-russian-vpn-phishing-185-221-196-118-20260516.json", "url": "https://the-hunters-ledger.com/stix/inkognito-russian-vpn-phishing-185-221-196-118-20260516.json", "report_url": "https://the-hunters-ledger.com/reports/inkognito-russian-vpn-phishing-185-221-196-118-20260516/", "bundle_id": "bundle--82fb9351-671b-430e-a3f2-b1af481fa69b", "report_id": "report--65f0c20d-2226-5d96-a2ae-82136af527b6", "sha256": "179489c319b14232ab950c152c0e895057649a2a81388210ab64b56a83bf4a38", "bytes": 131063, "objects": 171, "indicators": 57, "modified": "2026-10-09T13:20:05.762483Z" }, { "slug": "opendirectory-79-137-192-3-20260515", "title": "Rhadamanthys MaaS Customer Deep-Dive (79.137.192.3)", "date": "2026-05-15", "file": "opendirectory-79-137-192-3-20260515.json", "url": "https://the-hunters-ledger.com/stix/opendirectory-79-137-192-3-20260515.json", "report_url": "https://the-hunters-ledger.com/reports/opendirectory-79-137-192-3-20260515/", "bundle_id": "bundle--17e883a2-1d56-409a-834b-fc9ae62df0a4", "report_id": "report--11bf7544-c216-50a4-bf64-e2aa27a28014", "sha256": "1842ea359b8131ce0a13b2d6e50ab65d3ef7178b36866d51474990a0c41b3243", "bytes": 618174, "objects": 809, "indicators": 65, "modified": "2026-10-09T13:20:10.659194Z" }, { "slug": "opendirectory-62-60-237-100-20260506", "title": "HijackLoader / Penguish / Rugmi to AsyncRAT Multi-Vector Phishing Campaign", "date": "2026-05-06", "file": "opendirectory-62-60-237-100-20260506.json", "url": "https://the-hunters-ledger.com/stix/opendirectory-62-60-237-100-20260506.json", "report_url": "https://the-hunters-ledger.com/reports/opendirectory-62-60-237-100-20260506/", "bundle_id": "bundle--1cdf2377-ecbd-40ee-be02-50f6c6c24a33", "report_id": "report--aeece79f-37fb-57b6-9eac-f7fa0ff37e78", "sha256": "36471c37acec0005437ac8bd8da9e9e7d3ab34fbb7a7803e8f1a34186c545d66", "bytes": 577058, "objects": 766, "indicators": 45, "modified": "2026-10-09T13:20:10.195968Z" }, { "slug": "opendirectory-45-130-148-125-20260430", "title": "AdaptixC2 Open Directory Exposure (45.130.148.125)", "date": "2026-04-30", "file": "opendirectory-45-130-148-125-20260430.json", "url": "https://the-hunters-ledger.com/stix/opendirectory-45-130-148-125-20260430.json", "report_url": "https://the-hunters-ledger.com/reports/opendirectory-45-130-148-125-20260430/", "bundle_id": "bundle--285db8b2-3c0b-448f-a834-b0ca45cb30a5", "report_id": "report--fc7cbb43-66c7-5373-b2ac-b5eb14fb24fd", "sha256": "655e45a007747e2f4e3f4fcb37869333b61f5c42389a404c083a9b73e727d172", "bytes": 294502, "objects": 379, "indicators": 22, "modified": "2026-10-01T19:54:18.135Z" }, { "slug": "open-directory-94-103-1-13-20260423", "title": "Chaos Ransomware (TorBrowserTor) Multi-Stage Loader (94.103.1.13)", "date": "2026-04-23", "file": "open-directory-94-103-1-13-20260423.json", "url": "https://the-hunters-ledger.com/stix/open-directory-94-103-1-13-20260423.json", "report_url": "https://the-hunters-ledger.com/reports/open-directory-94-103-1-13-20260423/", "bundle_id": "bundle--7acd534b-9126-4701-b248-33ba20c895b5", "report_id": "report--184081d9-0822-53f5-8dbb-36e94e7e2bf1", "sha256": "7f5080d34dea96bff06c9f66a1c94c369ba5ff0c07ae967d0da1bd2b6b2c02b6", "bytes": 810790, "objects": 1049, "indicators": 41, "modified": "2026-10-09T13:20:06.756995Z" }, { "slug": "shinyhunters-dls-91-215-85-22-20260417", "title": "ShinyHunters Data Leak Site (91.215.85.22)", "date": "2026-04-17", "file": "shinyhunters-dls-91-215-85-22-20260417.json", "url": "https://the-hunters-ledger.com/stix/shinyhunters-dls-91-215-85-22-20260417.json", "report_url": "https://the-hunters-ledger.com/reports/shinyhunters-dls-91-215-85-22-20260417/", "bundle_id": "bundle--aa1e05e8-85e8-451e-8ce0-cf8c591d2e65", "report_id": "report--5ff1b5a0-5d02-5631-a253-1a04ccb6db3a", "sha256": "54842547a9b2395e75e7e536cf703e538c5f891086a0269b2afcb00b422bebb4", "bytes": 69224, "objects": 75, "indicators": 20, "modified": "2026-10-09T13:20:12.72919Z" }, { "slug": "new-files-found-20260408", "title": "OpenStrike Expanded Toolkit — 106 New Files (2026-04-08)", "date": "2026-04-08", "file": "new-files-found-20260408.json", "url": "https://the-hunters-ledger.com/stix/new-files-found-20260408.json", "report_url": "https://the-hunters-ledger.com/reports/new-files-found-20260408/", "bundle_id": "bundle--e8480ce7-0663-4cf6-8e7c-58210b71a439", "report_id": "report--4515275f-b9be-56f7-a189-401e48c3836e", "sha256": "d79fa730c21d3181d1285b0b95e69ad748cb96f58e022087a51007824f23c3ab", "bytes": 190067, "objects": 236, "indicators": 25, "modified": "2026-10-01T19:54:15.210613Z" }, { "slug": "open-directory-172-105-0-126-20260406", "title": "OpenStrike Beacon Toolkit (172.105.0.126)", "date": "2026-04-06", "file": "open-directory-172-105-0-126-20260406.json", "url": "https://the-hunters-ledger.com/stix/open-directory-172-105-0-126-20260406.json", "report_url": "https://the-hunters-ledger.com/reports/open-directory-172-105-0-126-20260406/", "bundle_id": "bundle--9a4759a5-365c-4e34-9468-3722108c1492", "report_id": "report--275b389e-e02e-5042-8cc9-f20b55d10b10", "sha256": "60d7c5d94ddc8f4c28e9619b92dd6e86f8d2fbe2295ebeaa2369ddcf967521bc", "bytes": 92895, "objects": 119, "indicators": 13, "modified": "2026-10-01T19:54:15.600274Z" }, { "slug": "shadow-xworm-opendirectory", "title": "Shadow RAT & XWorm Open Directory Campaign", "date": "2026-04-05", "file": "shadow-xworm-opendirectory.json", "url": "https://the-hunters-ledger.com/stix/shadow-xworm-opendirectory.json", "report_url": "https://the-hunters-ledger.com/reports/shadow-xworm-opendirectory/", "bundle_id": "bundle--2ad7f41b-4727-4d1e-8eae-dc40a133cf43", "report_id": "report--d362fb2d-05fc-5938-936e-670754d7a6d8", "sha256": "d58a5721001fe8baf21f0637d6296f0222146e6edc0f441492b048775600a3d0", "bytes": 63918, "objects": 51, "indicators": 27, "modified": "2026-10-01T19:54:20.314372Z" }, { "slug": "open-directory-193-56-255-154-xiebroc2", "title": "Open Directory at 193.56.255.154 — XiebroC2 v3.1 & Covenant C2", "date": "2026-04-03", "file": "open-directory-193-56-255-154-xiebroc2.json", "url": "https://the-hunters-ledger.com/stix/open-directory-193-56-255-154-xiebroc2.json", "report_url": "https://the-hunters-ledger.com/reports/open-directory-193-56-255-154-xiebroc2/", "bundle_id": "bundle--d69f6c20-b1a8-4180-8892-584ff44629f7", "report_id": "report--0fe65056-4183-5b20-83a0-a9d992fbe09d", "sha256": "bacdea094f2bd97cea22f35a05f1170d28f558d92dfc9e481a43259c301f9c23", "bytes": 35326, "objects": 30, "indicators": 14, "modified": "2026-10-01T19:54:15.808183Z" }, { "slug": "zerotrace-74-0-42-25-20260316", "title": "ZeroTrace Multi-Family MaaS Operation (74.0.42.25)", "date": "2026-03-16", "file": "zerotrace-74-0-42-25-20260316.json", "url": "https://the-hunters-ledger.com/stix/zerotrace-74-0-42-25-20260316.json", "report_url": "https://the-hunters-ledger.com/reports/zerotrace-74-0-42-25-20260316/", "bundle_id": "bundle--f166a5e4-e39e-426c-a156-66ee7b25a2ba", "report_id": "report--6a5d5aeb-1950-5205-a90e-967908691438", "sha256": "4f9ec5ac79db168220fba52b62e0bda747718722a39586f4efc8349645074441", "bytes": 164905, "objects": 213, "indicators": 39, "modified": "2026-10-01T19:54:22.827099Z" }, { "slug": "sliver-open-directory", "title": "Sliver C2 Toolchain with ScareCrow Loader (45.94.31.220)", "date": "2026-03-10", "file": "sliver-open-directory.json", "url": "https://the-hunters-ledger.com/stix/sliver-open-directory.json", "report_url": "https://the-hunters-ledger.com/reports/sliver-open-directory/", "bundle_id": "bundle--a2f1c642-8361-41e2-9857-cc232d874fa6", "report_id": "report--ca5a5217-efd5-53a5-921f-c00641d56de7", "sha256": "a81548a0bdb7341671b4a55b09407aa1c13b8c61050901d68ad5ba16b063d8a0", "bytes": 58546, "objects": 52, "indicators": 18, "modified": "2026-09-19T20:28:04.715996Z" }, { "slug": "webserver-compromise-kit-91-236-230-250", "title": "Webserver Compromise Kit (91.236.230.250)", "date": "2026-02-20", "file": "webserver-compromise-kit-91-236-230-250.json", "url": "https://the-hunters-ledger.com/stix/webserver-compromise-kit-91-236-230-250.json", "report_url": "https://the-hunters-ledger.com/reports/webserver-compromise-kit-91-236-230-250/", "bundle_id": "bundle--11a2123d-f5c6-4b3e-8dd4-4c937851ab60", "report_id": "report--174f1d73-3bf5-57a8-be0f-c94576ac3b35", "sha256": "0fc87d249c5c2809b754acefef13a4d3102469a7b6719d65b0daf17b8c851f07", "bytes": 28335, "objects": 22, "indicators": 10, "modified": "2026-10-01T19:54:22.427865Z" }, { "slug": "remcos-opendirectory", "title": "Remcos RAT OpenDirectory Campaign", "date": "2026-02-10", "file": "remcos-opendirectory.json", "url": "https://the-hunters-ledger.com/stix/remcos-opendirectory.json", "report_url": "https://the-hunters-ledger.com/reports/remcos-opendirectory/", "bundle_id": "bundle--fad3f326-1237-4c73-aa5b-dd2e5d501614", "report_id": "report--cfe4d76a-a030-5b5a-874a-5f584b6c436b", "sha256": "3291e8e93d71c5c0646b0d0bf2ea24d0a5850f2f6b3a264d9af2deb380315446", "bytes": 54852, "objects": 41, "indicators": 17, "modified": "2026-10-09T13:20:11.21281Z" }, { "slug": "nsminer-cryptojacker", "title": "NsMiner: Multi-Stage Cryptojacking Operation", "date": "2026-02-05", "file": "nsminer-cryptojacker.json", "url": "https://the-hunters-ledger.com/stix/nsminer-cryptojacker.json", "report_url": "https://the-hunters-ledger.com/reports/nsminer-cryptojacker/", "bundle_id": "bundle--3cd61a58-4dff-4888-a56f-c3af4f2f82c8", "report_id": "report--f5cf2d3d-4ab7-5767-8849-d0cbf388e3c2", "sha256": "f5db7297350d4019d985638e1acd5664e6a7265da215a1c128afd03507eca305", "bytes": 21553, "objects": 28, "indicators": 7, "modified": "2026-09-19T20:27:57.517409Z" }, { "slug": "arsenal-237-new-files", "title": "Arsenal-237 New Files: Advanced Toolkit Analysis", "date": "2026-01-20", "file": "arsenal-237-new-files.json", "url": "https://the-hunters-ledger.com/stix/arsenal-237-new-files.json", "report_url": "https://the-hunters-ledger.com/reports/arsenal-237-new-files/", "bundle_id": "bundle--b8d3110b-4139-4579-8f0c-89bd7ef922a8", "report_id": "report--8f9bc8c6-2c90-58f4-be2e-d7b64faec4ab", "sha256": "0483b63c0417e58c9858cb6cc17c6ecc88a7e4425ee46e6444b6009fb0faa709", "bytes": 5562, "objects": 11, "indicators": 0, "modified": "2026-09-19T20:27:55.348312Z" }, { "slug": "109.230.231.37-Executive-Overview", "title": "Arsenal-237: Threat Actor R&D Repository Exposed", "date": "2026-01-18", "file": "109.230.231.37-Executive-Overview.json", "url": "https://the-hunters-ledger.com/stix/109.230.231.37-Executive-Overview.json", "report_url": "https://the-hunters-ledger.com/reports/109.230.231.37-Executive-Overview/", "bundle_id": "bundle--35aec711-2d5b-4d23-b87d-9a7f1c6e77ff", "report_id": "report--f7d6132b-1864-5856-bdc1-38468af72c7f", "sha256": "74102184b153c9f9333efb20dcd657704d66ef8846c54153e1f19b783ad75881", "bytes": 2016, "objects": 3, "indicators": 0, "modified": "2026-09-19T20:27:54.185364Z" }, { "slug": "dual-rat-analysis", "title": "Dual-RAT Analysis: Pulsar RAT vs. NjRAT/XWorm", "date": "2025-12-20", "file": "dual-rat-analysis.json", "url": "https://the-hunters-ledger.com/stix/dual-rat-analysis.json", "report_url": "https://the-hunters-ledger.com/reports/dual-rat-analysis/", "bundle_id": "bundle--a7cba4eb-6cd3-4991-8fac-94b812f909d4", "report_id": "report--5d4d9a1b-5e15-5ad5-9783-ae7ec6901915", "sha256": "e2a7e0a45d161deaa09ae70ea48af119a8cc52c003849e48ace534d3256b9980", "bytes": 35126, "objects": 20, "indicators": 13, "modified": "2026-10-01T19:54:12.95275Z" }, { "slug": "PULSAR-RAT", "title": "PULSAR RAT (server.exe) — Technical Analysis & Business Risk Assessment", "date": "2025-12-15", "file": "PULSAR-RAT.json", "url": "https://the-hunters-ledger.com/stix/PULSAR-RAT.json", "report_url": "https://the-hunters-ledger.com/reports/PULSAR-RAT/", "bundle_id": "bundle--6725a53b-8c2b-4331-93b1-3fbe0188b481", "report_id": "report--63c70a80-72cc-5e25-b84d-647b47fa5196", "sha256": "8d4696107fec91961e532edfed71c710062e69030e81149b71cc16a2efb4a250", "bytes": 23665, "objects": 19, "indicators": 7, "modified": "2026-09-19T20:27:54.315222Z" }, { "slug": "Hybrid-Loader-Stealer-Sogou", "title": "Hybrid Loader/Stealer Ecosystem Masquerading as Sogou", "date": "2025-11-20", "file": "Hybrid-Loader-Stealer-Sogou.json", "url": "https://the-hunters-ledger.com/stix/Hybrid-Loader-Stealer-Sogou.json", "report_url": "https://the-hunters-ledger.com/reports/Hybrid-Loader-Stealer-Sogou/", "bundle_id": "bundle--773b39fd-d451-4013-831d-4a2fd89ea37a", "report_id": "report--60de42bf-6fb0-59f8-8f0b-67e8bf184aaf", "sha256": "5dcf0ad0140e808b310333ec32d7eb5bad9b7df8992644d42b191bc948cc9b1d", "bytes": 18121, "objects": 12, "indicators": 7, "modified": "2026-10-09T13:20:02.556063Z" }, { "slug": "malware-analysis-houselet", "title": "Houselet.exe — The Go-Based Loader Masquerading as PlayStation Remote Play", "date": "2025-11-10", "file": "malware-analysis-houselet.json", "url": "https://the-hunters-ledger.com/stix/malware-analysis-houselet.json", "report_url": "https://the-hunters-ledger.com/reports/malware-analysis-houselet/", "bundle_id": "bundle--e4716154-ac5b-4837-8ad6-6adb737d5cd2", "report_id": "report--66cfa6ea-e048-5321-893d-ff84b9a53c13", "sha256": "c3b49ab9d1849e987d62c388641db70902aabd830b16c78e15855105338725cb", "bytes": 16324, "objects": 10, "indicators": 5, "modified": "2026-09-30T03:16:41.485138Z" }, { "slug": "AdvancedRouterScanner", "title": "AdvancedRouterScanner", "date": "2025-10-20", "file": "AdvancedRouterScanner.json", "url": "https://the-hunters-ledger.com/stix/AdvancedRouterScanner.json", "report_url": "https://the-hunters-ledger.com/reports/AdvancedRouterScanner/", "bundle_id": "bundle--2df5c068-46bd-4db9-8b83-af068bea4bb5", "report_id": "report--af611741-d070-5b5f-8109-0abf4ddf0afa", "sha256": "e7e3d1c779c6d57c8c3e2d5898d9676de96b96973b1848e027d1e6dfa148b0c7", "bytes": 7568, "objects": 9, "indicators": 2, "modified": "2026-09-19T20:27:54.222979Z" }, { "slug": "webshells-to-the-cloud", "title": "From Webshells to The Cloud", "date": "2025-10-15", "file": "webshells-to-the-cloud.json", "url": "https://the-hunters-ledger.com/stix/webshells-to-the-cloud.json", "report_url": "https://the-hunters-ledger.com/reports/webshells-to-the-cloud/", "bundle_id": "bundle--75091b81-3eb7-4f28-b733-0ef6688695be", "report_id": "report--3a042466-61a6-5b3e-a1f9-5c5412cffba2", "sha256": "6de03e31e309a295f047c4354c942386db2a273306a978e60e9305026e549204", "bytes": 25306, "objects": 28, "indicators": 9, "modified": "2026-10-01T19:54:22.586822Z" }, { "slug": "quasar-xworm-powershell", "title": "Quasar + XWorm + PowerShell", "date": "2025-10-10", "file": "quasar-xworm-powershell.json", "url": "https://the-hunters-ledger.com/stix/quasar-xworm-powershell.json", "report_url": "https://the-hunters-ledger.com/reports/quasar-xworm-powershell/", "bundle_id": "bundle--c18d353c-7dbd-4aec-b7e2-aa63283381de", "report_id": "report--b68533aa-3b85-5be9-a6db-a7265dc66bae", "sha256": "c33674a7906316a4b7c78b54340421007f7ba7e5dc6faa3d6a477f97eb7813dc", "bytes": 16409, "objects": 27, "indicators": 2, "modified": "2026-09-19T20:28:01.298469Z" } ] }