{ "publisher": "HackersEye Threat Intelligence", "reference": "HE-TI-ADV-2026-11-01", "snapshot": "2026-11-01", "scope": "Curated contextual observations, not a blocklist. Includes preserved 95306 collector references. Portal addresses, access pointers, unrelated legacy identity, and client-specific victim references excluded. No live host queried.", "observations": [ { "indicator": "45[.]192[.]102[.]149:8899", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Reported control/exfil endpoint; repository independently names host", "confidence": "High for commit reference; reported for operational role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "176[.]122[.]161[.]117", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Reported runner / MASTER_URL", "confidence": "Advisory-reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "101[.]35[.]246[.]71:18888", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Reported game/business API", "confidence": "Advisory-reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "154[.]213[.]181[.]207", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Reported worker / staging host", "confidence": "Advisory-reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "154[.]219[.]127[.]31", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Test/operations reference in commit", "confidence": "High for commit reference; reported for operational role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "exfilacct[.]blob[.]core[.]windows[.]net", "type": "Hostname", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Reported exfil storage hostname", "confidence": "Advisory-reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,10" }, { "indicator": "103[.]109[.]21[.]198:22", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Historical SSH relay fleet entry; credentials withheld", "confidence": "High for repository association", "asn": "AS4816", "provider": "China Telecom Guangdong", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9" }, { "indicator": "43[.]240[.]221[.]227:22", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Historical SSH relay fleet entry; credentials withheld", "confidence": "High for repository association", "asn": "AS58519", "provider": "China Telecom Ctcloud", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9" }, { "indicator": "124[.]248[.]67[.]181:22", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Historical SSH relay fleet entry; credentials withheld", "confidence": "High for repository association", "asn": "AS58461", "provider": "China Telecom Hangzhou IDC", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9" }, { "indicator": "110[.]42[.]103[.]114:56102", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "Historical SSH relay fleet entry; credentials withheld", "confidence": "High for repository association", "asn": "AS136188", "provider": "China Telecom Ningbo IDC", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 9" }, { "indicator": "154[.]38[.]99[.]69", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "historical operator-declared own infrastructure", "confidence": "High in engagement report; original excerpt reviewed", "asn": "AS18186", "provider": "Nebula Global LLC", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "38[.]182[.]151[.]3", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "historical operator-declared own infrastructure", "confidence": "High in engagement report; original excerpt reviewed", "asn": "AS18186", "provider": "Nebula Global LLC", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "95[.]169[.]6[.]12", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated", "role": "historical operator-declared own infrastructure", "confidence": "High in engagement report; original excerpt reviewed", "asn": "AS25820", "provider": "IT7 Networks", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "8[.]130[.]150[.]18", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 10; Inner Mongolia label; SSH port 22. Labels are not verified geolocation.; previously an associated cloud-host lead", "confidence": "High for pinned source listing; current deployment unverified", "asn": "AS37963", "provider": "Alibaba Cloud", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "39[.]96[.]146[.]230", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 8; Beijing label; SSH port 22. Labels are not verified geolocation.; previously an associated cloud-host lead", "confidence": "High for pinned source listing; current deployment unverified", "asn": "AS37963", "provider": "Alibaba Cloud", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "39[.]108[.]87[.]206", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "associated host; role unconfirmed", "confidence": "Medium in engagement report", "asn": "AS37963", "provider": "Alibaba Cloud", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "101[.]35[.]246[.]71", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "associated host; role unconfirmed", "confidence": "Medium in engagement report", "asn": "AS45090", "provider": "Tencent Cloud", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "188[.]239[.]11[.]127", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "associated host; role unconfirmed", "confidence": "Medium in engagement report", "asn": "AS136907", "provider": "Huawei Cloud", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "61[.]136[.]78[.]115", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "associated host; role unconfirmed", "confidence": "Medium in engagement report", "asn": "AS4837", "provider": "China Unicom", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "aigc[.]kartai88[.]com", "type": "Domain", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "review-only lead; not confirmed malicious", "confidence": "Low/review", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "aigc[.]umi6[.]com", "type": "Domain", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "review-only lead; not confirmed malicious", "confidence": "Low/review", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "api[.]wallet8[.]top", "type": "Domain", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "review-only lead; not confirmed malicious", "confidence": "Low/review", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "apixx5daguo[.]cc", "type": "Domain", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "review-only lead; not confirmed malicious", "confidence": "Low/review", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 9" }, { "indicator": "130[.]94[.]252[.]223:54565", "type": "Host:port", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "SOCKS proxy", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "130[.]94[.]254[.]199:54565", "type": "Host:port", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "SOCKS proxy", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "61[.]15[.]103[.]171", "type": "IPv4", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Proxy/backend-reach reference", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "194[.]90[.]31[.]172", "type": "IPv4", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Dual-role reference: egress and target backend; resolve context", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "Brightdata IL residential", "type": "Service", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Commercial proxy service", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "ProxyRack IL", "type": "Service", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Commercial proxy service", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "api[.]ez-captcha[.]com", "type": "Domain", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Captcha solving API", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "ez-captcha[.]com", "type": "Domain", "classification": "Shared service / egress", "cluster": "TGSEC-associated", "role": "Captcha solving service", "confidence": "Reported", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §9; preserved IOC evidence, sections 2,4,10" }, { "indicator": "77[.]107[.]99[.]203", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "185[.]22[.]60[.]103", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "70[.]39[.]130[.]220", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "113[.]25[.]1[.]167", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "118[.]73[.]70[.]32", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "14[.]119[.]66[.]81:30901", "type": "Host:port", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "194[.]5[.]82[.]160", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "194[.]5[.]82[.]141", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "194[.]5[.]82[.]143", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "212[.]107[.]29[.]198", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "212[.]107[.]29[.]199", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "65[.]49[.]217[.]168", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "187[.]15[.]94[.]9", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "47[.]108[.]106[.]137", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "154[.]83[.]86[.]183", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "103[.]244[.]91[.]81", "type": "IPv4", "classification": "Associated / review", "cluster": "TGSEC-associated", "role": "Other-engagement egress, jump or panel reference; ownership unconfirmed", "confidence": "Medium in source; role unconfirmed", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review only; role unconfirmed", "source": "HackersEye preserved IOC evidence, sections 3" }, { "indicator": "github[.]com/lanyz1", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Primary repository owner; GitHub ID 189613774", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "github[.]com/lanyz1/TGSEC-Qtzuu", "type": "Repository", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Knowledge/skill collection", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "github[.]com/lanyz1/Qtzuu-pentest-toolbox", "type": "Repository", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Skill framework", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "github[.]com/lanyz1/haidaochuan", "type": "Repository", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Release/update channel", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "github[.]com/lanyz1/haidaochuan/releases/tag/v1[.]0[.]14", "type": "Release", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "ARTEX and toolkit co-distribution", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "guaixiaobei1@foxmail[.]com", "type": "Email", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Commit author label; not proof of real identity", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "tgsec@tgsec[.]com", "type": "Email", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Commit organization label", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "tgsec[.]com", "type": "Domain", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Organization-domain reference; domain registration does not establish campaign control", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "lanyz1@users[.]noreply[.]github[.]com", "type": "Email", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Commit noreply label", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "TGSEC-Qtzuu@users[.]noreply[.]github[.]com", "type": "Email", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Commit noreply label", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "ser596830521118", "type": "Hostname", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Committer-hostname artifact", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "root@ser596830521118[.]local", "type": "Email artifact", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Committer label; not an authenticated identity", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "t[.]me/pixshujubot", "type": "Telegram handle", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Delivery-bot reference; source-reported role", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "8753396940", "type": "Telegram bot ID", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Reported loot-sync / gambling-bot association", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "okayngpc28bot", "type": "Telegram handle", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Reported bot handle", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "NYJTPC20BOT", "type": "Telegram handle", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Reported sibling bot", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "t[.]me/nuoya918", "type": "Telegram handle", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Reported settlement/cashier reference", "confidence": "Observed label / source-reported role", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§6,13; preserved IOC evidence, sections 1,10" }, { "indicator": "github[.]com/lettiad9321", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/mirjkb", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/peiqi886", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/tolinke", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/yu994419160", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/Yufeifeio", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/a15846", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/fakedon", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/huasheng505", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/j2580133-wq", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/ksamabir980-svg", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/qinian11", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/sumingfine", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/wudongzi10-spec", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/xivvixen", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/yanbozhao854-dot", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "github[.]com/yu7777777777", "type": "Account", "classification": "Identity / distribution", "cluster": "TGSEC-associated", "role": "Captured redistribution owner; no common-control conclusion", "confidence": "High for captured presence; ownership unresolved", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Attribution or download pivot; does not prove account control", "source": "Preserved repository, profile and commit records; reviewed 1 November 2026" }, { "indicator": "89a5acb10db8f00385c07c0e8b1a1184fc855e94c74a81efc9cd3e3e42541dfa", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "artex-1.0.14-darwin-amd64.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "d9e05c19b39fb049d52c2009414d09dfbc7e803118ae5e37b0f906a6dea8131d", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "artex-1.0.14-darwin-arm64.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "6678fb8e7354ecc51a7ef73aa4b8b5ecf625aa789de98e3503ea8b3046178c1d", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "artex-1.0.14-linux-amd64.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "576788cc404e6bba20f271b9f822dce98c2c532f93c0dc48a02de1cee7a4794f", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "artex-1.0.14-linux-arm64.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "cecffd1834ea6623a5a37f9023dfcdbae7be71a0a910cd8b8833203fe2017bea", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "artex-1.0.14-windows-amd64.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "521cfb16b3b35546a0aac8cdfa081f5bf79adc0f890663a9e5a1d0a4b6d7712b", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "TGSEC-toolkit-1.0.13-simple.zip; archive digest, not extracted executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; release metadata" }, { "indicator": "norma/0.4", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported ARTEX user-agent", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "artex-selfupdate", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported updater user-agent", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "/artex-*", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported probe-path pattern", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "AI.HackTool.ARTEX", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Vendor detection name", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "guangxi_police_cert.py", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported certificate/signing-tool filename; no signing key included", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "abraxas", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported exploit-pipeline name; not a unique malware indicator", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "OKPay", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported payment/workflow reference; not itself malicious", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "Noah Group", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported gambling-brand reference", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "/root/.fleet_creds", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported credential-store path; no values", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "/root/mjump", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported runner directory", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "mjump.py", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Multi-host runner filename", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "*ForTest", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported test-field pattern", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "x-thor-error-code", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Proxy response-header clue", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "/tmp/lyc_loot/", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported staging directory", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "/nacos_cfg/", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported configuration collection path", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "yzc-fileupload", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Reported object-store bucket name", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "kk8-tma-gambling", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Target-related skill/platform label", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "CLAUDE.md", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Agent instruction entry file; legitimate filename, not a standalone IOC", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "AGENTS.md", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Agent instruction entry file; legitimate filename, not a standalone IOC", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": ".cursorrules", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Agent instruction entry file; legitimate filename", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": ".aider.conf.yml", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Agent configuration filename; legitimate filename", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": ".claude/skills/", "type": "Artifact / pattern", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "Skill-registration directory; legitimate path", "confidence": "Context only", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§5–13" }, { "indicator": "38[.]244[.]50[.]120:18899", "type": "Host:port", "classification": "Infrastructure", "cluster": "South Korea finance", "role": "Reported host/open directory", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "154[.]201[.]79[.]246", "type": "IPv4", "classification": "Shared service / egress", "cluster": "South Korea finance", "role": "Reported proxy API", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "205[.]214[.]59[.]31", "type": "IPv4", "classification": "Shared service / egress", "cluster": "South Korea finance", "role": "Reported proxy API", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "xcai[.]pro/v1", "type": "URL", "classification": "Shared service / egress", "cluster": "South Korea finance", "role": "Reported LLM gateway", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "144[.]172[.]64[.]99", "type": "IPv4", "classification": "Infrastructure", "cluster": "Storm-0940", "role": "Sign-in / Graph infrastructure", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "October 2026; vendor report 2026-10-21", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "144[.]172[.]64[.]128", "type": "IPv4", "classification": "Infrastructure", "cluster": "Storm-0940", "role": "Sign-in / Graph infrastructure", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "October 2026; vendor report 2026-10-21", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "144[.]172[.]64[.]60", "type": "IPv4", "classification": "Infrastructure", "cluster": "Storm-0940", "role": "Sign-in / Graph infrastructure", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "October 2026; vendor report 2026-10-21", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "187[.]15[.]88[.]186", "type": "IPv4", "classification": "Shared service / egress", "cluster": "Storm-0940", "role": "Transient VPN address observed with affected apps", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "2026-10-15 to 2026-10-16", "recommended_use": "Hunt in context; do not blanket-block", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "187[.]15[.]90[.]217", "type": "IPv4", "classification": "Shared service / egress", "cluster": "Storm-0940", "role": "Transient VPN address observed with affected apps", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "2026-10-15 to 2026-10-16", "recommended_use": "Hunt in context; do not blanket-block", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "187[.]15[.]89[.]186", "type": "IPv4", "classification": "Shared service / egress", "cluster": "Storm-0940", "role": "Transient VPN address observed with affected apps", "confidence": "Vendor telemetry", "asn": "", "provider": "", "observation_window": "2026-10-15 to 2026-10-16", "recommended_use": "Hunt in context; do not blanket-block", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "506e08f9-6e9a-4da4-942b-a099a03644ae", "type": "Application ID", "classification": "Artifact / behavior", "cluster": "Storm-0940", "role": "remote-management supplier Cloud Backup; legitimate app identity reportedly abused", "confidence": "Verified full ID from vendor", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review app permissions, sign-ins and Graph activity; presence alone is not abuse", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "24205314-2b89-4e07-a2a4-579e898a5640", "type": "Application ID", "classification": "Artifact / behavior", "cluster": "Storm-0940", "role": "remote-management supplier MS Teams; legitimate app identity reportedly abused", "confidence": "Verified full ID from vendor", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review app permissions, sign-ins and Graph activity; presence alone is not abuse", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "0de14c77-b9b0-4137-9360-34878a929827", "type": "Application ID", "classification": "Artifact / behavior", "cluster": "Storm-0940", "role": "remote-management supplier MS Graph; legitimate app identity reportedly abused", "confidence": "Verified full ID from vendor", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Review app permissions, sign-ins and Graph activity; presence alone is not abuse", "source": "Microsoft cloud-identity investigation, 21 October 2026 (HE-R03)" }, { "indicator": "156[.]240[.]236[.]28", "type": "IPv4", "classification": "Infrastructure", "cluster": "Hong Kong / Ultra Suite", "role": "Reported HK-cluster indicator", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "156[.]240[.]236[.]27", "type": "IPv4", "classification": "Infrastructure", "cluster": "Hong Kong / Ultra Suite", "role": "Reported HK-cluster indicator", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "156[.]240[.]236[.]14", "type": "IPv4", "classification": "Infrastructure", "cluster": "Hong Kong / Ultra Suite", "role": "Reported HK-cluster indicator", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "gladdaily[.]vip", "type": "Domain", "classification": "Infrastructure", "cluster": "Hong Kong / Ultra Suite", "role": "Reported HK-cluster indicator", "confidence": "Advisory synthesis; role not revalidated", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Correlate historical telemetry; validate role before response", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved IOC evidence, sections 10" }, { "indicator": "Thordata:6666", "type": "Service / port", "classification": "Shared service / egress", "cluster": "Hong Kong / Ultra Suite", "role": "Shared residential proxy reference", "confidence": "Advisory synthesis", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Hunt in context; do not blanket-block", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13" }, { "indicator": "31[.]59[.]92[.]155", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-10-04 to 2026-10-20 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "31[.]56[.]206[.]187", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-09-27 to 2026-10-20 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "38[.]244[.]50[.]120", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "Not specified by JPCERT/CC JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "46[.]8[.]227[.]73", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-09-27 to 2026-10-19 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "64[.]44[.]24[.]195", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "From 2026-10-15 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "94[.]183[.]184[.]98", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-10-13 to 2026-10-19 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "94[.]183[.]184[.]254", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-10-03 to 2026-10-20 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "95[.]182[.]99[.]112", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-10-04 to 2026-10-19 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "176[.]65[.]144[.]71", "type": "IPv4", "classification": "Associated / review", "cluster": "Japan / AI-tool abuse", "role": "Case E source address across AI pentest-tool abuse; specific tool/actor not assigned", "confidence": "CERT-reported observation", "asn": "", "provider": "", "observation_window": "2026-09-23 to 2026-10-17 JST", "recommended_use": "Historical log correlation; may now be legitimately used", "source": "https://www.jpcert.or.jp/at/2026/at260030.html Case E" }, { "indicator": "github[.]com/Autumn-27", "type": "Account", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Original ARTEX author; not attributed as a campaign operator", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "github[.]com/Autumn-27/norma", "type": "Repository", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Agent-harness dependency v0.4.3 in surviving source", "confidence": "Source-reported lineage; dependency checked in primary source", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "github[.]com/Hinln/ARTEX", "type": "Repository", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Reported source backup; not actor ownership", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "github[.]com/BaaRai/ARTEX", "type": "Repository", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Reported translated build; not actor ownership", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "github[.]com/2561769445/ycode-auto-pentest", "type": "Repository", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Reported downstream variant; not actor ownership", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "github[.]com/Gollum-code/artex", "type": "Repository", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Reported scanner/coverage variant; not actor ownership", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "artex-demo[.]vercel[.]app", "type": "Hostname", "classification": "Framework provenance", "cluster": "Framework ecosystem; not actor attribution", "role": "Reported public demonstration console; not confirmed malicious", "confidence": "Advisory context", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Tool provenance only; do not infer compromise, malice or common control", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §§2,13" }, { "indicator": "e06c4968b920c2d47c9057813ac36c88cf56b3a052662ef6b00f270c9b4a0464", "type": "SHA-256", "classification": "Artifact / behavior", "cluster": "TGSEC-associated", "role": "SHA256SUMS manifest-file digest; not an executable", "confidence": "High for captured digest", "asn": "", "provider": "", "observation_window": "Historical; reviewed 2026-11-01", "recommended_use": "Contextual hunt; not unique to this actor", "source": "HackersEye advisory HE-TI-ADV-2026-11-01 §13; preserved release metadata" }, { "indicator": "8[.]133[.]188[.]178", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 0; Shanghai label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "114[.]66[.]40[.]208:25175", "type": "Host:port", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 1; Ningbo label; SSH port 25175. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "8[.]138[.]236[.]124", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 2; Guangzhou label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]108[.]152[.]60", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 3; Chengdu label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "8[.]133[.]212[.]134", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 4; Shanghai label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]108[.]173[.]230", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 5; Chengdu label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]104[.]139[.]212", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 6; Qingdao label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]107[.]124[.]62", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 7; Shenzhen label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]122[.]107[.]121", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 9; Wuhan label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "47[.]115[.]204[.]175", "type": "IPv4", "classification": "Infrastructure", "cluster": "TGSEC-associated / 95306", "role": "Repository-listed collector shard 11; Source label; SSH port 22. Labels are not verified geolocation.", "confidence": "High for pinned source listing; current deployment unverified", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "/data_pool", "type": "Artifact / path", "classification": "Artifact / behavior", "cluster": "TGSEC-associated / 95306", "role": "Repository-described merged data pool", "confidence": "Observed source reference", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "/data_raw", "type": "Artifact / path", "classification": "Artifact / behavior", "cluster": "TGSEC-associated / 95306", "role": "Repository-described collector output directory", "confidence": "Observed source reference", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "pix_bot_server", "type": "Artifact / path", "classification": "Artifact / behavior", "cluster": "TGSEC-associated / 95306", "role": "Repository-described bot-facing service; portal implementation link not independently traced", "confidence": "Observed source reference", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" }, { "indicator": "v6collector", "type": "Artifact / path", "classification": "Artifact / behavior", "cluster": "TGSEC-associated / 95306", "role": "Repository-described collector service name", "confidence": "Observed source reference", "asn": "", "provider": "", "observation_window": "Pinned repository snapshot; user captures supplied 2026-11-01", "recommended_use": "Historical log correlation; association does not establish current control or a particular intrusion", "source": "Preserved repository maintenance record; reviewed 1 November 2026" } ] }