type:OSINT,osint:lifetime="perpetual",tlp:white,tlp:clear,misp-galaxy:tool="HALFRIG",misp-galaxy:mitre-attack-pattern="Virtual Private Server - T1583.003",misp-galaxy:mitre-attack-pattern="Compromise Infrastructure - T1584",misp-galaxy:mitre-attack-pattern="Phishing - T1566",misp-galaxy:mitre-attack-pattern="Spearphishing Attachment - T1566.001",misp-galaxy:mitre-attack-pattern="User Execution - T1204",misp-galaxy:mitre-attack-pattern="Malicious File - T1204.002",misp-galaxy:mitre-attack-pattern="Registry Run Keys / Startup Folder - T1547.001",misp-galaxy:mitre-attack-pattern="DLL Search Order Hijacking - T1574.001",misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002",misp-galaxy:mitre-attack-pattern="HTML Smuggling - T1027.006",misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-attack-pattern="Mark-of-the-Web Bypass - T1553.005",admiralty-scale:source-reliability="a",estimative-language:confidence-in-analytic-judgment="high",estimative-language:likelihood-probability="almost-certain"