This blogpost covers newly found actions attributed to FrostyNeighbor, focusing on governmental organizations in Ukraine. FrostyNeighbor has been working continuous cyberoperations, altering and updating its toolset repeatedly, updating its compromise chain and strategies to evade detection \u2013 focusing on victims situated in Japanese Europe, in accordance with our telemetry.<\/p>\n

\n
Key factors of the report:<\/strong><\/p>\n
\n
FrostyNeighbor is a long-running cyberespionage actor apparently aligned with the pursuits of Belarus.<\/li>\n
The group primarily targets governmental, navy, and key sectors in Japanese Europe.<\/li>\n
This report paperwork new exercise noticed that began in March 2026, displaying continued evolution of tooling and compromise chains.<\/li>\n
FrostyNeighbor makes use of server-side validation of its victims earlier than delivering the ultimate payload.<\/li>\n
The group has been lively not too long ago in campaigns focusing on governmental organizations in Ukraine.<\/li>\n<\/ul>\n<\/blockquote>\n
Introduction<\/h2>\n
FrostyNeighbor, also referred to as Ghostwriter, UNC1151, UAC\u20110057, TA445, PUSHCHA, or Storm-0257, is a bunch allegedly working from Belarus<\/a>. In response to Mandiant<\/a>, the group has been lively since not less than 2016. The vast majority of FrostyNeighbor\u2019s operations have focused international locations neighboring Belarus; a small minority have been noticed in different European international locations. FrostyNeighbor performs campaigns that make the most of spearphishing, unfold disinformation, and try and affect<\/a> their targets (just like the Ghostwriter affect exercise<\/a>) however has additionally compromised a wide range of governmental and personal sector entities, with a concentrate on Ukraine, Poland, and Lithuania.<\/p>\n
FrostyNeighbor has demonstrated a continued evolution in its ways, methods, and procedures (TTPs), leveraging over time a various arsenal of malware and supply mechanisms to focus on entities. Key developments embrace the deployment of a number of variants of the group\u2019s principal payload downloader, named PicassoLoader by CERT-UA<\/a>. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++. The identify comes from the truth that it retrieves a Cobalt Strike<\/a> beacon, from an attacker-controlled setting, disguised as a renderable picture or hidden in a web-associated file kind, like CSS, JS, or SVG. Cobalt Strike is a post-exploitation framework broadly used each by pentesters and risk actors, and its related beacon acts as an preliminary implant, permitting the attacker to completely management the compromised sufferer\u2019s laptop.<\/p>\n
Furthermore, the group makes use of all kinds of lure paperwork to compromise its targets, equivalent to CHM, XLS, PPT, or DOC, and it has exploited the WinRAR vulnerability CVE\u20112023\u201138831<\/a>. FrostyNeighbor has additionally exploited professional companies equivalent to Slack for payload supply, and Canarytokens<\/a> for sufferer monitoring, complicating detection and attribution efforts.<\/p>\n
Whereas Ukrainian focusing on appears to be targeted on navy, protection sector, and governmental entities, the victimology in Poland and Lithuania is broader and consists of, amongst others, all kinds of sectors like industrial and manufacturing, healthcare and prescribed drugs, logistics, and lots of governmental organizations. As this report is solely primarily based on our telemetry, different campaigns towards entities in international locations in the identical area can’t be excluded.<\/p>\n
FrostyNeighbor has performed spearphishing campaigns focusing on customers of Polish organizations, specializing in main free e mail suppliers equivalent to Interia Poczta<\/a> and Onet Poczta<\/a>. These campaigns included spoofed login pages designed to reap credentials. Moreover, CERT-PL<\/a> reported that the group exploited the CVE\u20112024\u201142009<\/a> XSS vulnerability in Roundcube, which allows JavaScript execution upon opening of weaponized e mail messages, to exfiltrate the sufferer\u2019s credentials. This displays the group\u2019s effort in each malware compromise and credential harvesting.<\/p>\n
Previous publications<\/h2>\n
FrostyNeighbor\u2019s campaigns have been lively for years and have subsequently been broadly documented publicly over time. A few of these embrace studies from July 2024, when CERT-UA<\/a> reported a few surge of exercise attributed to the group, focusing on Ukrainian governmental entities. In February 2025, SentinelOne<\/a> documented a surge of exercise focusing on Ukrainian authorities and opposition activists in Belarus, utilizing new diversifications of beforehand noticed payloads.<\/p>\n
In August 2025, HarfangLab<\/a> noticed new clusters of exercise that concerned malicious archives in particular compromise chains to focus on Ukrainian and Polish entities. Lastly, in December 2025, StrikeReady<\/a> documented a brand new anti-analysis approach, utilizing dynamic CAPTCHAs that the victims needed to remedy, executed by a VBA macro within the lure doc.<\/p>\n
Newly found exercise<\/h2>\n
Since March 2026, we’ve got detected new actions that we attributed to FrostyNeighbor, utilizing hyperlinks in malicious PDFs despatched by way of spearphishing attachments to focus on governmental organizations in Ukraine. The compromise chain is the latest noticed so far, utilizing a JavaScript model of PicassoLoader to ship a Cobalt Strike payload, as illustrated in Determine\u00a01.<\/p>\n
$\"Figure$
Determine 1. Compromise chain overview<\/em><\/figcaption><\/figure>\nIt begins with a blurry lure PDF file named 53_7.03.2026_R.pdf<\/span>, proven in Determine\u00a02, impersonating the Ukrainian telecommunications firm Ukrtelecom<\/a>, with a message that it purportedly \u201censures dependable defending of buyer information\u201d<\/em> (machine translated), and a obtain button with a hyperlink resulting in a doc hosted on a supply server managed by the group.<\/p>\n
$\"Figure$ Determine 2. PDF lure doc with a distant obtain hyperlink<\/em><\/figcaption><\/figure>\nIf the sufferer is just not from the anticipated geographic location, the server delivers a benign PDF file with the identical identify, 53_7.03.2026_R.pdf<\/span>, associated to rules within the subject of digital communications from 2024 to 2026 from Ukraine\u2019s Nationwide Fee for the State Regulation of Digital Communications, Radio Frequency Spectrum and the Provision of Postal Providers (nkek.gov.ua<\/a>), as proven in Determine\u00a03.<\/p>\n
$\"Figure$
Determine 3. Decoy PDF file associated to strategic priorities and rules within the subject of digital communications<\/em><\/figcaption><\/figure>\n
If the sufferer is utilizing an IP deal with from Ukraine, the server as an alternative delivers a RAR archive named 53_7.03.2026_R.rar<\/span>, containing the primary stage of the assault named 53_7.03.2026_R.js<\/span> \u2013 a JavaScript file that drops and shows a PDF file as a decoy. Concurrently, it additionally executes the second stage: a JavaScript model of the PicassoLoader downloader, recognized for use by the group. The primary-stage script has been deobfuscated and refactored for readability, with a shortened model offered in Determine\u00a04.<\/p>\n
$\"Figure$
Determine 4. First-stage JavaScript dropper<\/em> 53_7.03.2026_R.js<\/span><\/figcaption><\/figure>\n
On first execution, the script decodes and shows to the sufferer the identical PDF decoy illustrated in Determine\u00a03, and executes itself with the \u2011\u2011replace<\/span> flag to succeed in the opposite part of the code; the opposite flags aren’t used in any respect.<\/p>\n
Throughout the second execution, the script drops the second-stage downloader (PicassoLoader), which is embedded within the script (encoded utilizing base64) as %AppDatapercentWinDataScopeUpdate.js<\/span>, and downloads a scheduled job template from https:\/\/book-happy.needbinding[.]icu\/wp-content\/uploads\/2023\/10\/1GreenAM.jpg<\/span>, as proven in Determine\u00a05.<\/p>\n
$\"Figure$
Determine 5. Scheduled job template downloaded from the C&C server<\/em><\/figcaption><\/figure>\n
Regardless of a JPG picture being requested, the server responds with text-based content material, utilizing the Content material-Kind and Content material-Disposition headers to promote an XML attachment from their C&C server hosted behind the Cloudflare infrastructure:<\/p>\n
Content material-Kind: utility\/xml<\/span>
Server: cloudflare<\/span>
Content material-Disposition: attachment; filename=”config.xml”<\/span><\/p>\n
To realize persistence and set off the primary execution of PicassoLoader, the script then replaces the placeholder values with the info parsed from the response file 1GreenAM.jpg<\/span>:<\/p>\n
The primary stage, 53_7.03.2026_R.js<\/span>, additionally drops a REG file below %AppDatapercentWinDataScope<\/span> as WinUpdate.reg<\/span>, whose contents are imported into the registry by the PicassoLoader downloader. The PicassoLoader script has been deobfuscated and refactored for readability, with a shortened model offered in Determine\u00a06.<\/p>\n
$\"Figure$
Determine 6. Second-stage JavaScript PicassoLoader downloader<\/em><\/figcaption><\/figure>\n
When working, PicassoLoader fingerprints the sufferer\u2019s laptop by amassing the username, laptop identify, OS model, the boot time of the pc, the present time, and the record of working processes with their course of IDs (PIDs). Each 10\u00a0minutes, the compromised laptop\u2019s fingerprint is shipped to the C&C server by way of an HTTP POST request to https:\/\/book-happy.needbinding[.]icu\/employment\/documents-and-resources<\/span>. If the C&C server response content material is bigger than 100\u00a0bytes, the obtained information is executed utilizing the eval<\/span> technique.<\/p>\n
The choice whether or not or to not ship a payload may be very seemingly manually carried out by the operators, primarily based on the collected data to determine if the sufferer is of curiosity. If they’re, the C&C server responds with a third-stage JavaScript dropper for Cobalt Strike; in any other case, it returns an empty response. This third-stage script has been deobfuscated and refactored for readability, with a shortened model offered in Determine\u00a07.<\/p>\n
$\"Figure$
Determine 7. Third-stage Cobalt Strike dropper<\/em><\/figcaption><\/figure>\n
This extra script begins by copying the professional rundll32.exe<\/span> to %ProgramDatapercentViberPC.exe<\/span>, very more likely to bypass some safety mechanisms or detection guidelines.<\/p>\n
Then, a Cobalt Strike beacon embedded on this stage is base64 decoded and written to disk as %ProgramDatapercentViberPC.dll<\/span>. Lastly, persistence is achieved by creating and importing a REG file named ViberPC.reg<\/span>, which registers within the HKCU Run key<\/a> a LNK file, named %ProgramDatapercentViberPC.lnk<\/span>, that executes the copied model of rundll32.exe<\/span> with the command line argument %ProgramDatapercentViberPC.dll<\/span>, calling its DLL export SettingTimeAPI<\/span>.<\/p>\n
The ultimate payload is a Cobalt Strike beacon that contacts its C&C server at https:\/\/nama-belakang.nebao[.]icu\/statistics\/uncover.txt<\/span>.<\/p>\n
Conclusion<\/h2>\n
FrostyNeighbor stays a persistent and adaptive risk actor, demonstrating a excessive degree of operational maturity with using numerous lure paperwork, evolving lure and downloader variants, and new supply mechanisms. This latest compromise chain we detected is a continuation of the group\u2019s willingness to replace and renew its arsenal, attempting to evade detection to compromise its targets.<\/p>\n
The group\u2019s campaigns proceed to concentrate on Japanese Europe, with a notable emphasis on the governmental, protection, and key sectors, particularly in Poland, Lithuania, and Ukraine, in accordance with ESET telemetry.<\/p>\n
The payload is simply delivered after server-side sufferer validation, combining automated checks of the requesting consumer agent and IP deal with with the guide validation by the operators. Steady and shut monitoring of the group\u2019s operations, infrastructure, and toolset adjustments is important to detect and mitigate future operations.<\/p>\n
\n
For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com<\/a>.\u00a0<\/em><\/div>\n
ESET Analysis affords non-public APT intelligence studies and information feeds. For any inquiries about this service, go to the ESET Menace Intelligence<\/a> web page.<\/em><\/div>\n<\/blockquote>\n
IoCs<\/h2>\n
A complete record of indicators of compromise (IoCs) and samples might be present in our GitHub repository<\/a>.<\/p>\n
Recordsdata<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
SHA\u20111<\/strong><\/td>\n Filename<\/strong><\/td>\n Detection<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
776A43E46C36A539C916ED426745EE96E2392B39<\/span><\/td>\n 53_7.03.2026_R.rar<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.E<\/td>\n Lure RAR archive.<\/td>\n<\/tr>\n
8D1F2A6DF51C7783F2EAF1A0FC0FF8D032E5B57F<\/span><\/td>\n 53_7.03.2026_R.js<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.E<\/td>\n JavaScript dropper.<\/td>\n<\/tr>\n
B65551D339AECE718EA1465BF3542C794C445EFC<\/span><\/td>\n Replace.js<\/span><\/td>\n JS\/TrojanDownloader.FrostyNeighbor.D<\/td>\n JavaScript PicassoLoader downloader.<\/td>\n<\/tr>\n
E15ABEE1CFDE8BE7D87C7C0B510450BAD6BC0906<\/span><\/td>\n Replace.js<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.D<\/td>\n Cobalt Strike dropper.<\/td>\n<\/tr>\n
43E30BE82D82B24A6496F6943ECB6877E83F88AB<\/span><\/td>\n ViberPC.dll<\/span><\/td>\n Win32\/CobaltStrike.Beacon.S<\/td>\n Cobalt Strike beacon.<\/td>\n<\/tr>\n
4F2C1856325372B9B7769D00141DBC1A23BDDD14<\/span><\/td>\n 53_7.03.2026_R.pdf<\/span><\/td>\n PDF\/TrojanDownloader.FrostyNeighbor.D<\/td>\n Lure PDF doc.<\/td>\n<\/tr>\n
D89E5524E49199B1C3B66C524E7A63C3F0A0C199<\/span><\/td>\n Certificates.pdf<\/span><\/td>\n PDF\/TrojanDownloader.FrostyNeighbor.E<\/td>\n Lure PDF doc.<\/td>\n<\/tr>\n
7E537D8E91668580A482BD77A5A4CABA26D6BDAC<\/span><\/td>\n certificates.js<\/span><\/td>\n JS\/TrojanDownloader.FrostyNeighbor.G<\/td>\n JavaScript PicassoLoader downloader.<\/td>\n<\/tr>\n
FA6882672AD3654800987613310D7C3FBADE027E<\/span><\/td>\n certificates.js<\/span><\/td>\n JS\/TrojanDownloader.FrostyNeighbor.E<\/td>\n JavaScript PicassoLoader downloader.<\/td>\n<\/tr>\n
3FA7D1B13542F1A9EB054111F9B69C250AF68643<\/span><\/td>\n \u0421\u0435\u0442\u0438\u0444\u0456\u043a\u0430\u0442_CAF.rar<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.G<\/td>\n Lure RAR archive.<\/td>\n<\/tr>\n
4E52C92709A918383E90534052AAA257ACE2780C<\/span><\/td>\n \u0421\u0435\u0442\u0438\u0444\u0456\u043a\u0430\u0442_CAF.js<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.G<\/td>\n JavaScript dropper.<\/td>\n<\/tr>\n
6FDED427A16D5314BA3E1EB9AFD120DC84449769<\/span><\/td>\n EdgeTaskMachine.js<\/span><\/td>\n JS\/TrojanDropper.FrostyNeighbor.F<\/td>\n JavaScript PicassoLoader downloader.<\/td>\n<\/tr>\n
27FA11F6A1D653779974B6FB54DE4AF47F211232<\/span><\/td>\n EdgeSystemConfig.dll<\/span><\/td>\n Win32\/CobaltStrike.Beacon.S<\/td>\n Cobalt Strike beacon.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Community<\/h3>\n\n\n\n\n\n\n\n\n\n\n\n\n
IP<\/strong><\/td>\n Area<\/strong><\/td>\n Internet hosting supplier<\/strong><\/td>\n First seen<\/strong><\/td>\n Particulars<\/strong><\/td>\n<\/tr>\n<\/thead>\n
N\/A<\/td>\n attachment-storage-asset-static.needbinding[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201103\u201110<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n book-happy.needbinding[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201103\u201110<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n nama-belakang.nebao[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201103\u201110<\/td>\n Cobalt Strike C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n easiestnewsfromourpointofview.algsat[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201104\u201114<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n mickeymousegamesdealer.alexavegas[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201103\u201126<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n hinesafar.sardk[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201104\u201114<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n shinesafar.sardk[.]icu<\/span><\/td>\n N\/A<\/td>\n 2026\u201104\u201114<\/td>\n PicassoLoader C&C server.<\/td>\n<\/tr>\n
N\/A<\/td>\n best-seller.lavanille[.]buzz<\/span><\/td>\n N\/A<\/td>\n 2026\u201104\u201114<\/td>\n Cobalt Strike C&C server.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
MITRE ATT&CK methods<\/h2>\n
This desk was constructed utilizing model 18 <\/a>of the MITRE ATT&CK framework.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Tactic<\/strong><\/td>\n ID<\/strong><\/td>\n Identify<\/strong><\/td>\n Description<\/strong><\/td>\n<\/tr>\n<\/thead>\n
Useful resource Improvement<\/strong><\/td>\n T1583<\/a><\/td>\n Purchase Infrastructure<\/td>\n FrostyNeighbor acquires domains and rents C&C servers.<\/td>\n<\/tr>\n
T1608<\/a><\/td>\n Stage Capabilities<\/td>\n FrostyNeighbor hosts the ultimate payload on a C&C server.<\/td>\n<\/tr>\n
T1588.002<\/a><\/td>\n Receive Capabilities: Device<\/td>\n FrostyNeighbor obtained a leaked model of Cobalt Strike to generate payloads.<\/td>\n<\/tr>\n
Preliminary Entry<\/strong><\/td>\n T1566.001<\/a><\/td>\n Phishing: Spearphishing Attachment<\/td>\n FrostyNeighbor sends a weaponized lure doc in e mail attachments.<\/td>\n<\/tr>\n
Execution<\/strong><\/td>\n T1204.002<\/a><\/td>\n Consumer Execution: Malicious File<\/td>\n FrostyNeighbor tips its victims into opening or modifying a doc to realize code execution.<\/td>\n<\/tr>\n
T1053.005<\/a><\/td>\n Scheduled Job\/Job: Scheduled Job<\/td>\n FrostyNeighbor makes use of scheduled duties to realize persistence.<\/td>\n<\/tr>\n
T1059<\/a><\/td>\n Command and Scripting Interpreter<\/td>\n FrostyNeighbor makes use of scripting languages equivalent to JavaScript, Visible Fundamental, and PowerShell.<\/td>\n<\/tr>\n
Persistence<\/strong><\/td>\n T1060<\/a><\/td>\n Registry Run Keys \/ Startup Folder<\/td>\n FrostyNeighbor makes use of the registry Run key and the Startup Folder to realize persistence.<\/td>\n<\/tr>\n
Protection Evasion<\/strong><\/td>\n T1027<\/a><\/td>\n Obfuscated Recordsdata or Data<\/td>\n FrostyNeighbor obfuscates scripts and compiled binaries.<\/td>\n<\/tr>\n
T1027.009<\/a><\/td>\n Obfuscated Recordsdata or Data: Embedded Payloads<\/td>\n FrostyNeighbor embeds subsequent levels or payloads contained in the preliminary lure doc.<\/td>\n<\/tr>\n
T1036.005<\/a><\/td>\n Masquerading: Match Reputable Useful resource Identify or Location<\/td>\n FrostyNeighbor drops malicious recordsdata utilizing frequent Microsoft filenames and areas.<\/td>\n<\/tr>\n
Discovery<\/strong><\/td>\n T1057<\/a><\/td>\n Course of Discovery<\/td>\n PicassoLoader collects the record of working processes.<\/td>\n<\/tr>\n
T1082<\/a><\/td>\n System Data Discovery<\/td>\n PicassoLoader collects system and consumer data.<\/td>\n<\/tr>\n
Command and Management<\/strong><\/td>\n T1071.001<\/a><\/td>\n Utility Layer Protocol: Internet Protocols<\/td>\n FrostyNeighbor makes use of HTTPS for C&C communication and payload supply.<\/td>\n<\/tr>\n
Exfiltration<\/strong><\/td>\n T1041<\/a><\/td>\n Exfiltration Over C2 Channel<\/td>\n FrostyNeighbor makes use of HTTPS with Cobalt Strike.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
$\"\"$ <\/a><\/p>\n<\/div>\n\n","protected":false},"excerpt":{"rendered":"
This blogpost covers newly found actions attributed to FrostyNeighbor, focusing on governmental organizations in Ukraine. FrostyNeighbor has been working continuous cyberoperations, altering and updating its toolset repeatedly, updating its compromise chain and strategies to evade detection \u2013 focusing on victims situated in Japanese Europe, in accordance with our telemetry. Key factors of the report: FrostyNeighbor […]<\/p>\n","protected":false},"author":2,"featured_media":14920,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[1687,3138,9129,9130],"class_list":["post-14918","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-digital","tag-fresh","tag-mischief","tag-shenanigans"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14918","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=14918"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14918\/revisions"}],"predecessor-version":[{"id":14919,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/14918\/revisions\/14919"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/14920"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14918"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14918"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14918"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

IoCs<\/h2>\nA complete record of indicators of compromise (IoCs) and samples might be present in our GitHub repository<\/a>.<\/p>\n

IoCs<\/h2>\n
A complete record of indicators of compromise (IoCs) and samples might be present in our GitHub repository<\/a>.<\/p>\n