📃Title: Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia
📅Date: 2026-05-19
🔗References:
https://www.group-ib.com/blog/indonesia-tax-impersonation-goldfactory-malware/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• TA-category="Cybercrime"
• target="broad-based"
• topic="mobile-attack"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Group-IB"
• target-information="Indonesia"
• target-information="Peru"
• target-information="Philippines"
• target-information="South Africa"
• target-information="Thailand"
• malpedia="Gigabud"
• sector="Bank"
• sector="Finance"
• sector="Government, Administration"
• malpedia="GoldDigger"
• malpedia="Remo"
• threat-actor="GoldFactory"
mitre-attack-pattern=['T1414', 'T1646', 'T1541', 'T1417.002', 'T1516', 'T1417.001', 'T1660', 'T1513', 'T1426', 'T1437.001', 'T1626', 'T1417', 'T1418', 'T1422']

MISP event uuid: 88e3ed61-0d4d-462b-9c4c-2298d7d7b9c3

📃Title: Popular node-ipc npm Package Infected with Credential Stealer
📅Date: 2026-05-14
🔗References:
https://socket.dev/blog/node-ipc-package-compromised

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="37ebf9d7-5e9a-466f-a42c-6e60313db868"
mitre-attack-pattern=['T1195.002', 'T1078', 'T1136', 'T1098', 'T1071.004', 'T1048.003', 'T1041', 'T1567', 'T1005', 'T1552.001', 'T1552.004', 'T1087', 'T1082', 'T1083', 'T1119', 'T1074.001', 'T1560.001', 'T1027', 'T1027.002', 'T1059.007']

MISP event uuid: ba313d52-d178-491a-ab42-0a79bdd9755b

📃Title: Inside a Tor Backed Supply Chain Worm
📅Date: 2026-05-14
🔗References:
https://www.cloudsek.com/blog/inside-a-tor-backed-supply-chain-worm

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="CloudSEK"
mitre-attack-pattern=['T1195.002', 'T1554', 'T1543.002', 'T1027', 'T1078.004', 'T1078.001', 'T1087.001', 'T1552.001', 'T1552.006', 'T1563', 'T1098', 'T1036.005', 'T1090.003', 'T1071.001', 'T1059.006', 'T1548.001', 'T1496', 'T1005', 'T1041']

MISP event uuid: 76c07ddc-0f70-481e-9f63-c99aef0650b6

📃Title: The Evolution of ClickFix: From Cleartext to Server Side Polymorphism
📅Date: 2026-05-14
🔗References:
https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• workflow="enrichment"
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"

🔖MISP Galaxies:
• malpedia="Vidar"
• malpedia="DeerStealer"
mitre-attack-pattern=['T1204.001', 'T1566.002', 'T1059.001', 'T1027', 'T1140', 'T1071.001', 'T1105', 'T1055', 'T1112', 'T1497', 'T1070.004', 'T1082', 'T1555.003', 'T1555', 'T1539', 'T1005', 'T1041', 'T1027.002']

MISP event uuid: 6d14d444-58c0-45da-92e5-fca9cdcd7637

📃Title: Infostealer Campaign Using Trading App as Lure
📅Date: 2026-05-20
🔗References:
https://hybrid-analysis.blogspot.com/2026/05/velvet-chollima-infostealer-campaign.html?m=1

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Hybrid Analysis"
mitre-attack-pattern=['T1566', 'T1204', 'T1036', 'T1553.002', 'T1547.001', 'T1053.005', 'T1059.001', 'T1027', 'T1105', 'T1082', 'T1012', 'T1518.001', 'T1056.001', 'T1555.003', 'T1567.001', 'T1071.001', 'T1132', 'T1497', 'T1497.001', 'T1614']

MISP event uuid: 08b137bc-104f-4dcc-a5ab-09ec9ce19b7b

📃Title: APT Targets Azerbaijani Oil and Gas Industry
📅Date: 2026-05-13
🔗References:
https://businessinsights.bitdefender.com/famoussparrow-apt-targets-azerbaijani-oil-gas-industry

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="campaign-analysis"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Bitdefender"
• target-information="Azerbaijan"
• threat-actor="GhostEmperor"
• country="china"
• malpedia="SNAPPYBEE"
• sector="Gas"
• sector="Oil"
mitre-attack-pattern=['T1190', 'T1505.003', 'T1543.003', 'T1574.002', 'T1140', 'T1562', 'T1569.002', 'T1059.001', 'T1021.001', 'T1021.002', 'T1071.001', 'T1014']

MISP event uuid: 4513c651-0f6c-417a-8390-6a800dc28872

📃Title: Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers
📅Date: 2026-05-21
🔗References:
https://hunt.io/blog/middle-east-malicious-infrastructure-report

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="infra-profile"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Hunt.io"
mitre-attack-pattern=['T1543', 'T1071.004', 'T1566.001', 'T1053', 'T1106', 'T1140', 'T1190', 'T1583.001', 'T1036', 'T1055', 'T1497', 'T1059.001', 'T1098', 'T1562.001', 'T1078', 'T1027', 'T1573', 'T1071.001', 'T1136', 'T1105', 'T1204.001']

MISP event uuid: c40393cf-c35a-4e9c-89f7-442e9743e034

📃Title: The Gentleman Ransomware | Defense Evasion TTPs Uncovered
📅Date: 2026-05-21
🔗References:
https://www.huntress.com/blog/the-gentlemen-ransomware-defense-evasion-ttps

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="intrusion-analysis"
• TA-category="Ransomware"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Huntress"
• ransomware="the gentlemen"
mitre-attack-pattern=['T1053.005', 'T1033', 'T1133', 'T1548.002', 'T1036.005', 'T1082', 'T1112', 'T1070.001', 'T1083', 'T1057', 'T1059.001', 'T1562.001', 'T1078', 'T1027', 'T1486', 'T1071.001', 'T1018', 'T1105', 'T1021.001', 'T1090.001']

MISP event uuid: bf870fb8-ded6-4287-a5f5-d67eb365e5e6

📃Title: One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign
📅Date: 2026-05-21
🔗References:
https://www.trendmicro.com/en_us/research/26/e/inside-the-influence-and-fraud-patriot-bait-campaign.html

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• sub-category="campaign-analysis"
• topic="crypto-related"
• TA-category="Cybercrime"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Trend Micro"
• target-information="United States"
mitre-attack-pattern=[]

MISP event uuid: 955d2000-1779-4eef-85e8-245ce2a74d15

📃Title: KerjaExpress Campaign - Android Banking Trojan Targeting Malaysian Financial Institutions
📅Date: 2026-05-23
🔗References:

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: ⚔ Threat
• sub-category="campaign-analysis"
• topic="mobile-attack"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• sector="Finance"
• target-information="Malaysia"
mitre-attack-pattern=['T1476', 'T1437', 'T1406', 'T1660', 'T1453', 'T1636.002', 'T1412', 'T1512', 'T1429', 'T1417.001', 'T1430', 'T1657']

MISP event uuid: 375deb1c-52ff-499f-a96e-6229a2ed4673

📃Title: Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
📅Date: 2026-05-26
🔗References:
https://cloud.google.com/blog/topics/threat-intelligence/knowledgedeliver-viewstate-deserialization-vulnerability

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• target="targeted"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Mandiant"
• target-information="Japan"
mitre-attack-pattern=['T1036.005', 'T1204.002', 'T1566.002', 'T1222.001', 'T1082', 'T1106', 'T1190', 'T1070.006', 'T1505.003', 'T1087', 'T1083', 'T1057', 'T1059.001', 'T1547.001', 'T1027.005', 'T1068', 'T1027', 'T1573', 'T1059.003', 'T1071.001']

MISP event uuid: 7d11ee85-edb4-4c0d-8857-1c31a3bbf632

📃Title: Laravel Lang Compromised with RCE Backdoor Across 700+ Versions
📅Date: 2026-05-23
🔗References:
https://socket.dev/blog/laravel-lang-compromise

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="supply-chain"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="37ebf9d7-5e9a-466f-a42c-6e60313db868"
mitre-attack-pattern=['T1552.005', 'T1555.001', 'T1573.001', 'T1555.005', 'T1552.002', 'T1082', 'T1140', 'T1555.003', 'T1552.004', 'T1078.001', 'T1083', 'T1552.001', 'T1552.006', 'T1059.004', 'T1027', 'T1195.002', 'T1071.001', 'T1078.004', 'T1552.007']

MISP event uuid: 9fd4e771-9d30-4b3d-bdc9-9f5c6fa70541

📃Title: From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
📅Date: 2026-05-22
🔗References:
https://www.microsoft.com/en-us/security/blog/2026/05/22/from-edge-appliance-to-enterprise-compromise-multi-stage-linux-intrusion-via-f5-and-confluence/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="intrusion-analysis"
• topic="cloud"
• target="targeted"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Microsoft"
mitre-attack-pattern=['T1557', 'T1222.002', 'T1021.004', 'T1071', 'T1005', 'T1190', 'T1083', 'T1059.004', 'T1187', 'T1078.002', 'T1059.006', 'T1505', 'T1105', 'T1043']

MISP event uuid: fd752467-0d11-47e9-a740-deaf9985264d

📃Title: Fast and Furious - Nimbus Manticore Operations During the Iranian Conflict
📅Date: 2026-05-22
🔗References:
https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="campaign-analysis"
• topic="geopolitical"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Check Point"
• target-information="United States"
• target-information="Australia"
• target-information="Saudi Arabia"
• target-information="Israel"
• target-information="United Arab Emirates"
• threat-actor="UNC1549"
• country="iran"
mitre-attack-pattern=['T1053.005', 'T1033', 'T1132.001', 'T1036.005', 'T1204.002', 'T1573.001', 'T1566.002', 'T1566.001', 'T1082', 'T1106', 'T1140', 'T1083', 'T1057', 'T1041', 'T1027', 'T1059.003', 'T1189', 'T1071.001', 'T1574.002', 'T1105']

MISP event uuid: 5795b1d1-efb3-404b-91f4-3cc22a56ccd9

📃Title: Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns
📅Date: 2026-05-22
🔗References:
https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• topic="geopolitical"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Palo Alto"
• target-information="United States"
• target-information="Israel"
• target-information="United Arab Emirates"
• country="iran"
• threat-actor="UNC1549"
mitre-attack-pattern=['T1053.005', 'T1036.005', 'T1204.002', 'T1566.001', 'T1082', 'T1106', 'T1140', 'T1055', 'T1218', 'T1083', 'T1036.004', 'T1057', 'T1041', 'T1547.001', 'T1562.001', 'T1027', 'T1059.003', 'T1070.004', 'T1071.001', 'T1574.002']

MISP event uuid: cbfd6ef2-719f-4544-af73-580b5f764c5c

📃Title: Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
📅Date: 2026-05-22
🔗References:
https://securelist.com/cloud-atlas-2026/119895/

🔖Rectifyq Taxonomies:
Relevancy: ⚫ Not Relevant
Category: ⚔ Threat
• mitre-att&ck="none-from-src"
• mitre-att&ck="from-OTX"
• sub-category="TA-profile"
• TA-category="APT"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• producer="Kaspersky"
• target-information="Belarus"
• target-information="Russia"
• threat-actor="Inception Framework"
• sector="Diplomacy"
• sector="Government, Administration"
mitre-attack-pattern=['T1003.002', 'T1074.001', 'T1087.002', 'T1204.002', 'T1566.001', 'T1005', 'T1140', 'T1055', 'T1572', 'T1090', 'T1482', 'T1059.001', 'T1547.001', 'T1078', 'T1027', 'T1573', 'T1071.001', 'T1018', 'T1021.001', 'T1558.003']

MISP event uuid: 7f23650f-d187-4f77-8965-5a32f48fdd80

📃Title: RemotePE: The Lazarus RAT that lives in memory
📅Date: 2026-05-25
🔗References:
https://blog.fox-it.com/2026/05/22/remotepe-the-lazarus-rat-that-lives-in-memory/

🔖Rectifyq Taxonomies:
Relevancy: 🔵 Potentially Relevant
Category: ⚔ Threat
• mitre-att&ck="from-original-src"
• mitre-att&ck="from-OTX"
• sub-category="malware-analysis"
• TA-category="APT"
• target="broad-based"
• samples-found-in="MalwareBazaar"
• samples-found-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• threat-actor="Lazarus Group"
mitre-attack-pattern=['T1543.003', 'T1082', 'T1106', 'T1005', 'T1140', 'T1055', 'T1560', 'T1562.006', 'T1083', 'T1036.004', 'T1497', 'T1057', 'T1562.001', 'T1027', 'T1573', 'T1132', 'T1027.002', 'T1071.001', 'T1574.002', 'T1480.001']

MISP event uuid: 97638d90-a35a-4490-80dd-f2e3d548c42e

📃Title: MTNew-v3Campaign Advanced Banking Trojan Targeting Malaysian Financial Sector
📅Date: 2026-05-24
🔗References:

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: ⚔ Threat
• sub-category="malware-analysis"
• topic="mobile-attack"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• target-information="Malaysia"
• sector="Finance"
mitre-attack-pattern=['T1660', 'T1476', 'T1406.002', 'T1437', 'T1437.001', 'T1406', 'T1417.001', 'T1412', 'T1513', 'T1429', 'T1446']

MISP event uuid: c3e3d1a1-2a9e-420d-b8f0-16a801149af0

📃Title: MaxTag Malware Family
📅Date: 2026-05-25
🔗References:

🔖Rectifyq Taxonomies:
Relevancy: 🔴 Highly Relevant
Category: ⚔ Threat
• sub-category="malware-analysis"
• topic="mobile-attack"
• target="broad-based"
• no-samples-in="MalwareBazaar"
• no-samples-in="Tria.ge"
• action-taken="VT-comment"

🔖MISP Galaxies:
• target-information="Malaysia"
• sector="Finance"
mitre-attack-pattern=['T1429', 'T1412', 'T1417', 'T1516', 'T1411', 'T1461', 'T1444', 'T1406', 'T1582', 'T1603', 'T1513', 'T1481']

MISP event uuid: dcc49ea4-0a45-434b-ad1e-44d68b14b954