{"id": "6a01c14d4138e8c33a19b4d7", "name": "Operation HumanitarianBait: An Infostealer Campaign in Disguise", "description": "Cyble Research and Intelligence Labs (CRIL) has uncovered a targeted cyberespionage campaign using aid-themed lures in a Russian aid request form, as well as a fileless Python infostealer.", "author_name": "CyberHunter_NL", "modified": "2026-06-10T11:10:28.171000", "created": "2026-05-11T11:45:17.392000", "tags": ["report", "figure", "lnk file", "python", "c2 server", "access", "github releases", "rustdesk", "persistence", "collection", "powershell", "execution", "anydesk", "payload", "telegram", "defense evasion", "infostealer", "malware", "download", "desktop", "win64", "next", "scroll"], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": ["T1005", "T1027", "T1036", "T1041", "T1053", "T1056", "T1059", "T1071", "T1105", "T1113", "T1115", "T1204", "T1219", "T1539", "T1552", "T1555", "T1566", "T1003", "T1074", "T1547"], "industries": [], "TLP": "white", "indicators": [{"id": 4353928720, "indicator": "393b498f2114cabc0b29d5fcd9dc6723", "type": "FileHash-MD5", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "MD5 of 8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79", "expiration": null, "is_active": 1}, {"id": 4353928721, "indicator": "da5ac54159f5f816c3791fa04747ddb8", "type": "FileHash-MD5", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "MD5 of 9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21", "expiration": null, "is_active": 1}, {"id": 4353928722, "indicator": "037b2265a6107b24f45671d1c522cf5518fd62bd", "type": "FileHash-SHA1", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "SHA1 of 9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21", "expiration": null, "is_active": 1}, {"id": 4353928723, "indicator": "a0b80c0ec77f62b0ed46edb3fef05ccb88c74afb", "type": "FileHash-SHA1", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "SHA1 of 8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79", "expiration": null, "is_active": 1}, {"id": 4348912889, "indicator": "8a100cbdf79231e70cee2364ebd9a4433fda6b4de4929d705f26f7b68d6aeb79", "type": "FileHash-SHA256", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "", "expiration": null, "is_active": 1}, {"id": 4348912890, "indicator": "9be61c95056fd6b63565cf51a196f2615f5360c0a42e616b2a618473e9d60a21", "type": "FileHash-SHA256", "created": "2026-05-11T11:45:18", "content": "", "title": "ALF:AGGR:ExcelsiorNP.A:95!ml", "description": "", "expiration": null, "is_active": 1}, {"id": 4348912891, "indicator": "a5b782901829861a6f458db404e8ec1a99c65a48393525e681742bb2a5db454d", "type": "FileHash-SHA256", "created": "2026-05-11T11:45:18", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1}, {"id": 4164432637, "indicator": "http://143.0.0.0", "type": "URL", "created": "2026-05-11T11:45:18", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1}, {"id": 4353928724, "indicator": "http://159.198.41.140", "type": "URL", "created": "2026-05-11T11:45:18", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1}, {"id": 4348912893, "indicator": "http://159.198.41.140/static/builder/lnk_uploads/invo.pdf", "type": "URL", "created": "2026-05-11T11:45:18", "content": "", "title": "PDF document, version 1.4", "description": "f5d37493b12955b8c518028bf7dcb4a8a2ad190341fc30a27475fc8cd43e539d", "expiration": null, "is_active": 1}, {"id": 4348912894, "indicator": "http://159.198.41.140/test/index.php?r=survey/index&sid=936926&newtest=Y&lang=ru%22", "type": "URL", "created": "2026-05-11T11:45:18", "content": "", "title": "", "description": "", "expiration": null, "is_active": 1}], "revision": 1, "groups": [], "in_group": false, "author": {"username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false}, "is_subscribing": null}