{"format":"STIX 2.1","taxii":false,"policy":"public-only; preserve original attribution; no automatic blocking","collections":[{"id":"cisa","url":"https://eudoria.it/intel/stix/cisa.json"},{"id":"misp","url":"https://eudoria.it/intel/stix/misp.json"},{"id":"opencti","url":"https://eudoria.it/intel/stix/opencti.json"}],"cisa_coverage":[{"item_id":255956,"group":"Ghost (Cring)","title":"#StopRansomware: Ghost (Cring) Ransomware","status":"partial","ioc_values":65,"failed_attachments":0,"last_verified":"2026-09-26T06:00:37.959413+00:00"},{"item_id":256103,"group":null,"title":"Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities","status":"current","ioc_values":40,"failed_attachments":0,"last_verified":"2026-09-26T06:00:39.554315+00:00"},{"item_id":255968,"group":"RansomHub","title":"#StopRansomware: RansomHub Ransomware","status":"partial","ioc_values":121,"failed_attachments":1,"last_verified":"2026-09-26T06:31:10.950637+00:00"},{"item_id":255944,"group":null,"title":"Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure","status":"partial","ioc_values":21,"failed_attachments":1,"last_verified":"2026-09-26T06:31:11.692495+00:00"},{"item_id":255980,"group":null,"title":"PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure","status":"error","ioc_values":0,"failed_attachments":0,"last_verified":null},{"item_id":255981,"group":null,"title":"Known Indicators of Compromise Associated with Androxgh0st Malware","status":"partial","ioc_values":43,"failed_attachments":1,"last_verified":"2026-09-26T06:31:12.973276+00:00"},{"item_id":256018,"group":null,"title":"Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475","status":"partial","ioc_values":38,"failed_attachments":1,"last_verified":"2026-09-26T06:31:14.599535+00:00"},{"item_id":256054,"group":null,"title":"Protecting Against Malicious Use of Remote Monitoring and Management Software","status":"current","ioc_values":10,"failed_attachments":0,"last_verified":"2026-09-26T09:31:21.299548+00:00"},{"item_id":256021,"group":null,"title":"Threat Actors Exploiting Ivanti EPMM Vulnerabilities","status":"partial","ioc_values":266,"failed_attachments":1,"last_verified":"2026-09-26T07:02:08.386584+00:00"},{"item_id":255983,"group":"Play","title":"#StopRansomware: Play Ransomware","status":"partial","ioc_values":53,"failed_attachments":2,"last_verified":"2026-09-26T07:02:10.345251+00:00"},{"item_id":256077,"group":null,"title":"Threat Actors Chaining Unpatched VMware Vulnerabilities for Full System Control","status":"current","ioc_values":34,"failed_attachments":0,"last_verified":"2026-09-26T08:07:17.435509+00:00"},{"item_id":256023,"group":null,"title":"Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells","status":"partial","ioc_values":23,"failed_attachments":1,"last_verified":"2026-09-26T07:35:40.987775+00:00"},{"item_id":256042,"group":null,"title":"Threat Actors Exploit Progress Telerik Vulnerabilities in Multiple U.S. Government IIS Servers","status":"error","ioc_values":0,"failed_attachments":0,"last_verified":null},{"item_id":256043,"group":"Blacksuit (Royal)","title":"#StopRansomware: Blacksuit (Royal) Ransomware","status":"partial","ioc_values":238,"failed_attachments":2,"last_verified":"2026-09-26T07:35:45.304363+00:00"},{"item_id":256148,"group":null,"title":"AppleJeus: Analysis of North Korea’s Cryptocurrency Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:04:01.487261+00:00"},{"item_id":256078,"group":null,"title":"Threat Actors Exploiting F5 BIG-IP CVE-2022-1388","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:53.959183+00:00"},{"item_id":256075,"group":null,"title":"People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:53.640405+00:00"},{"item_id":256106,"group":null,"title":"APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus","status":"error","ioc_values":0,"failed_attachments":0,"last_verified":null},{"item_id":256019,"group":null,"title":"Identification and Disruption of QakBot Infrastructure","status":"partial","ioc_values":41,"failed_attachments":1,"last_verified":"2026-09-26T09:03:05.533317+00:00"},{"item_id":256164,"group":null,"title":"Iran-Based Threat Actor Exploits VPN Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T09:31:23.274231+00:00"},{"item_id":256165,"group":null,"title":"Chinese Ministry of State Security-Affiliated Cyber Threat Actor Activity","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T09:31:23.575752+00:00"},{"item_id":255970,"group":null,"title":"North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime’s Military and Nuclear Programs","status":"partial","ioc_values":382,"failed_attachments":1,"last_verified":"2026-09-26T04:09:02.660609+00:00"},{"item_id":256161,"group":null,"title":"Emotet Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T04:08:59.938536+00:00"},{"item_id":256213,"group":null,"title":"Microsoft Ending Support for Windows 7 and Windows Server 2008 R2","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:26.941101+00:00"},{"item_id":256186,"group":null,"title":"Top 10 Routinely Exploited Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:56.942791+00:00"},{"item_id":256190,"group":null,"title":"Microsoft Office 365 Security Recommendations","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:57.453961+00:00"},{"item_id":255941,"group":null,"title":"Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite","status":"current","ioc_values":27,"failed_attachments":0,"last_verified":"2026-09-25T22:01:13.467749+00:00"},{"item_id":256025,"group":null,"title":"Increased Truebot Activity Infects U.S. and Canada Based Networks","status":"partial","ioc_values":221,"failed_attachments":0,"last_verified":"2026-09-26T07:35:42.429334+00:00"},{"item_id":255967,"group":null,"title":"Russian Military Cyber Actors Target US and Global Critical Infrastructure","status":"partial","ioc_values":293,"failed_attachments":1,"last_verified":"2026-09-26T05:00:48.356633+00:00"},{"item_id":256090,"group":null,"title":"Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks","status":"current","ioc_values":81,"failed_attachments":0,"last_verified":"2026-09-26T04:30:40.022274+00:00"},{"item_id":256092,"group":null,"title":"Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:13.592682+00:00"},{"item_id":256068,"group":null,"title":"North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector","status":"current","ioc_values":19,"failed_attachments":0,"last_verified":"2026-09-26T08:07:20.037808+00:00"},{"item_id":256036,"group":"CL0P","title":"#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability","status":"partial","ioc_values":189,"failed_attachments":1,"last_verified":"2026-09-26T09:03:15.654965+00:00"},{"item_id":256166,"group":null,"title":"Technical Approaches to Uncovering and Remediating Malicious Activity","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:09.994981+00:00"},{"item_id":256211,"group":null,"title":"Potential for Iranian Cyber Response to U.S. Military Strike in Baghdad","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:26.666341+00:00"},{"item_id":256194,"group":null,"title":"Enterprise VPN Security","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:30.667176+00:00"},{"item_id":256215,"group":null,"title":"New Exploits for Unsecure SAP Systems","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:27.944158+00:00"},{"item_id":256101,"group":null,"title":"Mitigating Log4Shell and Other Log4j-Related Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:53.051508+00:00"},{"item_id":256107,"group":null,"title":"Ransomware Awareness for Holidays and Weekends","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:53.848202+00:00"},{"item_id":256192,"group":null,"title":"Guidance on the North Korean Cyber Threat","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:30.186702+00:00"},{"item_id":256193,"group":null,"title":"COVID-19 Exploited by Malicious Cyber Actors","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:30.485063+00:00"},{"item_id":251039,"group":null,"title":"China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:01:12.318794+00:00"},{"item_id":255975,"group":"Akira","title":"#StopRansomware: Akira Ransomware","status":"partial","ioc_values":164,"failed_attachments":1,"last_verified":"2026-09-26T05:30:34.369297+00:00"},{"item_id":256083,"group":null,"title":"TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies","status":"current","ioc_values":74,"failed_attachments":0,"last_verified":"2026-09-26T07:02:09.156137+00:00"},{"item_id":255945,"group":null,"title":"Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:31:06.193424+00:00"},{"item_id":255946,"group":null,"title":"CISA Shares Lessons Learned from an Incident Response Engagement","status":"current","ioc_values":16,"failed_attachments":0,"last_verified":"2026-09-25T22:31:11.176685+00:00"},{"item_id":255949,"group":null,"title":"CISA and USCG Identify Areas for Cyber Hygiene Improvement After Conducting Proactive Threat Hunt at US Critical Infrastructure Organization","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:31:11.574472+00:00"},{"item_id":255951,"group":null,"title":"Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:31:11.826053+00:00"},{"item_id":256039,"group":null,"title":"Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG","status":"partial","ioc_values":45,"failed_attachments":0,"last_verified":"2026-09-26T05:00:46.950764+00:00"},{"item_id":255954,"group":null,"title":"Fast Flux: A National Security Threat","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:03:05.853598+00:00"},{"item_id":255965,"group":null,"title":"2023 Top Routinely Exploited Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:03:07.868704+00:00"},{"item_id":255997,"group":null,"title":"Threat Actors Exploit Atlassian Confluence CVE-2023-22515 for Initial Access to Networks","status":"partial","ioc_values":4,"failed_attachments":1,"last_verified":"2026-09-26T06:31:13.615350+00:00"},{"item_id":255969,"group":null,"title":"Iran-based Cyber Actors Enabling Ransomware Attacks on US Organizations","status":"current","ioc_values":12,"failed_attachments":0,"last_verified":"2026-09-25T23:35:32.764257+00:00"},{"item_id":255979,"group":null,"title":"Threat Actor Leverages Compromised Account of Former Employee to Access State Government Organization","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:35:33.043792+00:00"},{"item_id":255991,"group":null,"title":"Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spearphishing Campaigns","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:31.108101+00:00"},{"item_id":256020,"group":null,"title":"2022 Top Routinely Exploited Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:32.718151+00:00"},{"item_id":256147,"group":null,"title":"Exploitation of Accellion File Transfer Appliance","status":"current","ioc_values":1997,"failed_attachments":0,"last_verified":"2026-09-26T08:30:38.485966+00:00"},{"item_id":256123,"group":null,"title":"DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:39.171242+00:00"},{"item_id":256153,"group":null,"title":"Advanced Persistent Threat Actors Targeting U.S. Think Tanks","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:35:53.750102+00:00"},{"item_id":255953,"group":null,"title":"Russian GRU Targeting Western Logistics Entities and Technology Companies","status":"current","ioc_values":78,"failed_attachments":0,"last_verified":"2026-09-25T23:03:05.547008+00:00"},{"item_id":256067,"group":null,"title":"2021 Top Malware Strains","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:57.400324+00:00"},{"item_id":256082,"group":null,"title":"Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:11.794852+00:00"},{"item_id":256085,"group":null,"title":"APT Cyber Tools Targeting ICS/SCADA Devices","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:12.107222+00:00"},{"item_id":256091,"group":null,"title":"New Sandworm Malware Cyclops Blink Replaces VPNFilter","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:13.192849+00:00"},{"item_id":256066,"group":"Zeppelin","title":"#StopRansomware: Zeppelin Ransomware","status":"current","ioc_values":144,"failed_attachments":0,"last_verified":"2026-09-26T09:31:22.393739+00:00"},{"item_id":256053,"group":null,"title":"ESXiArgs Ransomware Virtual Machine Recovery Guidance","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:55.107752+00:00"},{"item_id":256059,"group":null,"title":"Top CVEs Actively Exploited By People’s Republic of China State-Sponsored Cyber Actors","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:55.797554+00:00"},{"item_id":256061,"group":null,"title":"Control System Defense: Know the Opponent","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:56.091020+00:00"},{"item_id":256063,"group":null,"title":"Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:56.893463+00:00"},{"item_id":256069,"group":"MedusaLocker","title":"#StopRansomware: MedusaLocker","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:37.853228+00:00"},{"item_id":256122,"group":null,"title":"Sophisticated Spearphishing Campaign Targets Government Organizations, IGOs, and NGOs","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:38.985158+00:00"},{"item_id":256124,"group":null,"title":"Russian Foreign Intelligence Service (SVR) Cyber Operations: Trends and Best Practices for Network Defenders","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:39.755401+00:00"},{"item_id":255943,"group":null,"title":"Defending Against China-Nexus Covert Networks of Compromised Devices","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:31:05.784760+00:00"},{"item_id":255952,"group":null,"title":"Threat Actors Deploy LummaC2 Malware to Exfiltrate Sensitive Data from Organizations","status":"partial","ioc_values":135,"failed_attachments":1,"last_verified":"2026-09-26T05:00:47.691123+00:00"},{"item_id":241127,"group":null,"title":"Defending Against an Active Threat to Siemens S7 Series PLCs","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:01:12.517310+00:00"},{"item_id":255971,"group":null,"title":"CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:03:08.352666+00:00"},{"item_id":255978,"group":null,"title":"SVR Cyber Actors Adapt Tactics for Initial Cloud Access","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:35:30.871484+00:00"},{"item_id":255993,"group":null,"title":"IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities","status":"partial","ioc_values":5,"failed_attachments":1,"last_verified":"2026-09-26T05:00:49.126389+00:00"},{"item_id":256035,"group":null,"title":"Understanding Ransomware Threat Actors: LockBit","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:58.349316+00:00"},{"item_id":256041,"group":"LockBit 3.0","title":"#StopRansomware: LockBit 3.0","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:59.248303+00:00"},{"item_id":256152,"group":null,"title":"Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:35:53.436631+00:00"},{"item_id":256158,"group":null,"title":"Iranian Advanced Persistent Threat Actors Threaten Election-Related Systems","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:35:54.336188+00:00"},{"item_id":256040,"group":null,"title":"Hunting Russian Intelligence “Snake” Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:58.660242+00:00"},{"item_id":256159,"group":null,"title":"Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets","status":"current","ioc_values":17,"failed_attachments":0,"last_verified":"2026-09-26T03:35:55.573146+00:00"},{"item_id":256183,"group":null,"title":"Malicious Cyber Actor Use of Network Tunneling and Spoofing to Obfuscate Geolocation","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:55.868988+00:00"},{"item_id":256187,"group":null,"title":"APT Groups Target Healthcare and Essential Services","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:57.185324+00:00"},{"item_id":256060,"group":null,"title":"Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization","status":"current","ioc_values":91,"failed_attachments":0,"last_verified":"2026-09-26T05:30:28.747119+00:00"},{"item_id":256163,"group":null,"title":"LokiBot Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T04:09:00.563729+00:00"},{"item_id":255957,"group":null,"title":"Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications","status":"partial","ioc_values":82,"failed_attachments":1,"last_verified":"2026-09-26T04:09:01.177380+00:00"},{"item_id":255976,"group":"Phobos","title":"#StopRansomware: Phobos Ransomware","status":"partial","ioc_values":119,"failed_attachments":1,"last_verified":"2026-09-26T04:09:01.973883+00:00"},{"item_id":255996,"group":"Rhysida","title":"#StopRansomware: Rhysida Ransomware","status":"partial","ioc_values":161,"failed_attachments":2,"last_verified":"2026-09-26T05:00:50.387098+00:00"},{"item_id":255973,"group":"Black Basta","title":"#StopRansomware: Black Basta","status":"partial","ioc_values":234,"failed_attachments":1,"last_verified":"2026-09-26T04:30:34.720270+00:00"},{"item_id":255994,"group":"LockBit 3.0","title":"#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability","status":"partial","ioc_values":18,"failed_attachments":1,"last_verified":"2026-09-26T04:30:35.468626+00:00"},{"item_id":256017,"group":"Snatch","title":"#StopRansomware: Snatch Ransomware","status":"partial","ioc_values":71,"failed_attachments":1,"last_verified":"2026-09-26T04:30:36.312980+00:00"},{"item_id":256064,"group":"Vice Society","title":"#StopRansomware: Vice Society","status":"current","ioc_values":16,"failed_attachments":0,"last_verified":"2026-09-26T04:30:40.401244+00:00"},{"item_id":255982,"group":"ALPHV Blackcat","title":"#StopRansomware: ALPHV Blackcat","status":"partial","ioc_values":31,"failed_attachments":1,"last_verified":"2026-09-26T04:30:41.089782+00:00"},{"item_id":256197,"group":null,"title":"Critical Vulnerability in Citrix Application Delivery Controller, Gateway, and SD-WAN WANOP","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:31.581492+00:00"},{"item_id":256185,"group":null,"title":"Defending Against Malicious Cyber Activity Originating from Tor","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:56.586244+00:00"},{"item_id":256110,"group":null,"title":"Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:01:12.171190+00:00"},{"item_id":255940,"group":null,"title":"A Tale of Two SOCs: Insights From Two Red Team Assessments","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:01:12.722756+00:00"},{"item_id":256062,"group":null,"title":"Iranian State Actors Conduct Cyber Operations Against the Government of Albania","status":"current","ioc_values":39,"failed_attachments":0,"last_verified":"2026-09-26T05:30:29.096774+00:00"},{"item_id":256191,"group":null,"title":"Continued Threat Actor Exploitation Post Pulse Secure VPN Patching","status":"current","ioc_values":64,"failed_attachments":0,"last_verified":"2026-09-26T05:30:32.782163+00:00"},{"item_id":255977,"group":null,"title":"Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways","status":"partial","ioc_values":65,"failed_attachments":1,"last_verified":"2026-09-26T05:30:35.146211+00:00"},{"item_id":256105,"group":null,"title":"Ongoing Cyber Threats to U.S. Water and Wastewater Systems","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:53.546372+00:00"},{"item_id":255950,"group":"Interlock","title":"#StopRansomware: Interlock","status":"current","ioc_values":26,"failed_attachments":0,"last_verified":"2026-09-25T23:35:31.503319+00:00"},{"item_id":256127,"group":null,"title":"TrickBot Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:04:00.997858+00:00"},{"item_id":256016,"group":null,"title":"People's Republic of China-Linked Cyber Actors Hide in Router Firmware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:32.332586+00:00"},{"item_id":256079,"group":null,"title":"Weak Security Controls and Practices Routinely Exploited for Initial Access","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:54.237026+00:00"},{"item_id":256081,"group":null,"title":"2021 Top Routinely Exploited Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:55.239159+00:00"},{"item_id":255990,"group":null,"title":"Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally","status":"current","ioc_values":53,"failed_attachments":0,"last_verified":"2026-09-26T07:02:11.732793+00:00"},{"item_id":256024,"group":null,"title":"Enhanced Monitoring to Detect APT Activity Targeting Outlook Online","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:57.946778+00:00"},{"item_id":255998,"group":"AvosLocker","title":"#StopRansomware: AvosLocker Ransomware (Update)","status":"partial","ioc_values":24,"failed_attachments":1,"last_verified":"2026-09-26T07:35:41.666153+00:00"},{"item_id":256055,"group":"Cuba","title":"#StopRansomware: Cuba Ransomware","status":"current","ioc_values":178,"failed_attachments":0,"last_verified":"2026-09-26T08:07:18.231680+00:00"},{"item_id":256056,"group":"Hive","title":"#StopRansomware: Hive Ransomware","status":"current","ioc_values":30,"failed_attachments":0,"last_verified":"2026-09-26T08:07:18.920828+00:00"},{"item_id":256080,"group":null,"title":"Protecting Against Cyber Threats to Managed Service Providers and their Customers","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:54.734581+00:00"},{"item_id":256125,"group":null,"title":"Exploitation of Pulse Connect Secure Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:39.955429+00:00"},{"item_id":256126,"group":null,"title":"Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:04:00.097447+00:00"},{"item_id":256155,"group":null,"title":"Ransomware Activity Targeting the Healthcare and Public Health Sector","status":"current","ioc_values":73,"failed_attachments":0,"last_verified":"2026-09-26T08:30:39.736313+00:00"},{"item_id":256093,"group":null,"title":"2021 Trends Show Increased Globalized Threat of Ransomware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:57.358640+00:00"},{"item_id":256094,"group":null,"title":"Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:31:57.742998+00:00"},{"item_id":255948,"group":null,"title":"Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System","status":"source_empty","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T06:00:37.119677+00:00"},{"item_id":256212,"group":null,"title":"Dridex Malware","status":"current","ioc_values":29,"failed_attachments":0,"last_verified":"2026-09-26T06:00:38.555215+00:00"},{"item_id":256088,"group":null,"title":"Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability","status":"current","ioc_values":4,"failed_attachments":0,"last_verified":"2026-09-26T07:02:11.057774+00:00"},{"item_id":256037,"group":null,"title":"People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection","status":"partial","ioc_values":20,"failed_attachments":1,"last_verified":"2026-09-26T07:35:43.103365+00:00"},{"item_id":256052,"group":"Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities","title":"#StopRansomware: Ransomware Attacks on Critical Infrastructure Fund DPRK Malicious Cyber Activities","status":"current","ioc_values":229,"failed_attachments":0,"last_verified":"2026-09-26T08:07:16.939015+00:00"},{"item_id":256151,"group":null,"title":"Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations","status":"current","ioc_values":119,"failed_attachments":0,"last_verified":"2026-09-26T08:30:39.123508+00:00"},{"item_id":256167,"group":null,"title":"FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:10.503455+00:00"},{"item_id":256065,"group":null,"title":"Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite","status":"current","ioc_values":1,"failed_attachments":0,"last_verified":"2026-09-26T08:30:40.240392+00:00"},{"item_id":256121,"group":null,"title":"Chinese State-Sponsored Cyber Operations: Observed TTPs","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:31:38.664384+00:00"},{"item_id":256149,"group":null,"title":"Compromise of U.S. Water Treatment Facility","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:04:01.726968+00:00"},{"item_id":256150,"group":null,"title":"Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:04:02.000060+00:00"},{"item_id":256179,"group":null,"title":"Malicious Cyber Actor Spoofing COVID-19 Loan Relief Webpage via Phishing Emails","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:11.062563+00:00"},{"item_id":256154,"group":null,"title":"Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data","status":"current","ioc_values":38,"failed_attachments":0,"last_verified":"2026-09-26T08:30:40.772580+00:00"},{"item_id":256156,"group":null,"title":"North Korean Advanced Persistent Threat Focus: Kimsuky","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:35:54.043765+00:00"},{"item_id":256182,"group":null,"title":"NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:11.606736+00:00"},{"item_id":256198,"group":null,"title":"Critical Vulnerabilities in Microsoft Windows Operating Systems","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:26.072692+00:00"},{"item_id":256218,"group":null,"title":"Publicly Available Tools Seen in Cyber Incidents Worldwide","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:52.753702+00:00"},{"item_id":256214,"group":null,"title":"Microsoft Operating Systems BlueKeep Vulnerability","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:27.642741+00:00"},{"item_id":256216,"group":null,"title":"DNS Infrastructure Hijacking Campaign","status":"current","ioc_values":45,"failed_attachments":0,"last_verified":"2026-09-26T09:02:28.087423+00:00"},{"item_id":256104,"group":null,"title":"BlackMatter Ransomware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:53.347963+00:00"},{"item_id":241128,"group":"Gunra","title":"#StopRansomware: Gunra Ransomware","status":"current","ioc_values":31,"failed_attachments":0,"last_verified":"2026-09-26T03:04:02.836136+00:00"},{"item_id":255964,"group":null,"title":"Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a US Critical Infrastructure Sector Organization","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:03:07.464338+00:00"},{"item_id":255966,"group":null,"title":"Iranian Cyber Actors’ Brute Force and Credential Access Activity Compromises Critical Infrastructure Organizations","status":"current","ioc_values":76,"failed_attachments":0,"last_verified":"2026-09-25T23:35:32.033363+00:00"},{"item_id":255992,"group":null,"title":"Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers","status":"partial","ioc_values":6,"failed_attachments":1,"last_verified":"2026-09-26T09:02:48.226547+00:00"},{"item_id":256109,"group":null,"title":"Top Routinely Exploited Vulnerabilities","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:01:11.924713+00:00"},{"item_id":256087,"group":null,"title":"Strengthening Cybersecurity of SATCOM Network Providers and Customers","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:12.834672+00:00"},{"item_id":256089,"group":null,"title":"Update: Destructive Malware Targeting Organizations in Ukraine","status":"current","ioc_values":351,"failed_attachments":0,"last_verified":"2026-09-26T09:03:14.847340+00:00"},{"item_id":256180,"group":null,"title":"Potential Legacy Risk from Malware Targeting QNAP NAS Devices","status":"current","ioc_values":63,"failed_attachments":0,"last_verified":"2026-09-26T05:30:33.271808+00:00"},{"item_id":256051,"group":null,"title":"CISA Red Team Shares Key Findings to Improve Monitoring and Hardening of Networks","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T02:01:54.602331+00:00"},{"item_id":256057,"group":null,"title":"Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester","status":"partial","ioc_values":5,"failed_attachments":0,"last_verified":"2026-09-26T09:31:21.814926+00:00"},{"item_id":255955,"group":"Medusa","title":"#StopRansomware: Medusa Ransomware","status":"current","ioc_values":52,"failed_attachments":0,"last_verified":"2026-09-25T23:03:07.131911+00:00"},{"item_id":255972,"group":null,"title":"People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T23:35:30.646916+00:00"},{"item_id":256128,"group":null,"title":"Mitigate Microsoft Exchange Server Vulnerabilities","status":"current","ioc_values":23,"failed_attachments":0,"last_verified":"2026-09-26T09:31:22.896898+00:00"},{"item_id":255995,"group":null,"title":"Scattered Spider","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:31.527825+00:00"},{"item_id":256022,"group":null,"title":"Preventing Web Application Access Control Abuse","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:30:53.333433+00:00"},{"item_id":256086,"group":null,"title":"Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T01:01:12.600118+00:00"},{"item_id":256199,"group":null,"title":"Continued Exploitation of Pulse Secure VPN Vulnerability","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:30:26.318249+00:00"},{"item_id":256160,"group":null,"title":"APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T03:35:56.044705+00:00"},{"item_id":256162,"group":null,"title":"Potential for China Cyber Response to Heightened U.S.–China Tensions","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T04:09:00.239753+00:00"},{"item_id":256217,"group":null,"title":"SamSam Ransomware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:02:43.336386+00:00"},{"item_id":255942,"group":null,"title":"Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T22:31:02.684107+00:00"},{"item_id":256058,"group":"Daixin Team","title":"#StopRansomware: Daixin Team","status":"current","ioc_values":9,"failed_attachments":0,"last_verified":"2026-09-26T08:07:19.515978+00:00"},{"item_id":256120,"group":null,"title":"Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated with China’s MSS Hainan State Security Department","status":"partial","ioc_values":638,"failed_attachments":0,"last_verified":"2026-09-26T08:30:34.693977+00:00"},{"item_id":256178,"group":null,"title":"Phishing Emails Used to Deploy KONNI Malware","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:10.796377+00:00"},{"item_id":256181,"group":null,"title":"Threat Actor Exploitation of F5 BIG-IP CVE-2020-5902","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:01:11.360657+00:00"},{"item_id":256184,"group":null,"title":"Critical Vulnerability in SAP NetWeaver AS Java","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T10:33:56.319666+00:00"},{"item_id":256195,"group":null,"title":"Ransomware Impacting Pipeline Operations","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:30.980309+00:00"},{"item_id":256196,"group":null,"title":"Detecting Citrix CVE-2019-19781","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T11:06:31.228201+00:00"},{"item_id":256108,"group":null,"title":"BadAlloc Vulnerability Affecting BlackBerry QNX RTOS","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-25T21:30:55.849525+00:00"},{"item_id":256038,"group":"BianLian","title":"#StopRansomware: BianLian Ransomware Group","status":"current","ioc_values":13,"failed_attachments":0,"last_verified":"2026-09-26T05:00:51.087405+00:00"},{"item_id":256102,"group":null,"title":"APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus","status":"current","ioc_values":51,"failed_attachments":0,"last_verified":"2026-09-26T06:00:39.047948+00:00"},{"item_id":256076,"group":null,"title":"Karakurt Data Extortion Group","status":"current","ioc_values":32,"failed_attachments":0,"last_verified":"2026-09-26T07:02:08.697053+00:00"},{"item_id":256074,"group":null,"title":"Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems","status":"current","ioc_values":43,"failed_attachments":0,"last_verified":"2026-09-26T09:03:14.359204+00:00"},{"item_id":255984,"group":null,"title":"Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:30.818442+00:00"},{"item_id":255999,"group":null,"title":"NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations","status":"no_stix_attachment","ioc_values":0,"failed_attachments":0,"last_verified":"2026-09-26T00:00:32.025465+00:00"}]}