type:OSINT,osint:lifetime="perpetual",osint:certainty="50",tlp:white,tlp:clear,misp-galaxy:mitre-attack-pattern="Obtain Capabilities - T1588",misp-galaxy:mitre-attack-pattern="Digital Certificates - T1588.004",misp-galaxy:mitre-attack-pattern="Stage Capabilities - T1608",misp-galaxy:mitre-attack-pattern="Install Digital Certificate - T1608.003",misp-galaxy:mitre-attack-pattern="Exploit Public-Facing Application - T1190",misp-galaxy:mitre-attack-pattern="Supply Chain Compromise - T1195",misp-galaxy:mitre-attack-pattern="Compromise Software Supply Chain - T1195.002",misp-galaxy:mitre-attack-pattern="Hijack Execution Flow - T1574",misp-galaxy:mitre-attack-pattern="DLL Side-Loading - T1574.002",misp-galaxy:mitre-attack-pattern="Process Injection - T1055",misp-galaxy:mitre-attack-pattern="Obfuscated Files or Information - T1027",misp-galaxy:mitre-attack-pattern="Masquerading - T1036",misp-galaxy:mitre-attack-pattern="Invalid Code Signature - T1036.001",misp-galaxy:mitre-attack-pattern="Indicator Removal - T1070",misp-galaxy:mitre-attack-pattern="File Deletion - T1070.004",misp-galaxy:mitre-attack-pattern="Clear Windows Event Logs - T1070.001",misp-galaxy:mitre-attack-pattern="Modify Registry - T1112",misp-galaxy:mitre-attack-pattern="Deobfuscate/Decode Files or Information - T1140",misp-galaxy:mitre-attack-pattern="Virtualization/Sandbox Evasion - T1497",misp-galaxy:mitre-attack-pattern="System Checks - T1497.001",misp-galaxy:mitre-attack-pattern="Reflective Code Loading - T1620",misp-galaxy:mitre-attack-pattern="Debugger Evasion - T1622",misp-galaxy:mitre-attack-pattern="Query Registry - T1012",misp-galaxy:mitre-attack-pattern="System Information Discovery - T1082",misp-galaxy:mitre-attack-pattern="File and Directory Discovery - T1083",misp-galaxy:mitre-attack-pattern="System Location Discovery - T1614",misp-galaxy:mitre-attack-pattern="System Language Discovery - T1614.001",misp-galaxy:mitre-attack-pattern="DNS - T1071.004",misp-galaxy:mitre-attack-pattern="Web Protocols - T1071.001",misp-galaxy:mitre-attack-pattern="Application Layer Protocol - T1071",misp-galaxy:mitre-attack-pattern="Ingress Tool Transfer - T1105",misp-galaxy:mitre-attack-pattern="Asymmetric Cryptography - T1573.002",misp-galaxy:mitre-attack-pattern="Encrypted Channel - T1573",misp-galaxy:mitre-attack-pattern="Data Manipulation - T1565",misp-galaxy:mitre-attack-pattern="Stored Data Manipulation - T1565.001",misp-galaxy:backdoor="POOLRAT",misp-galaxy:malpedia="POOLRAT",misp-galaxy:malpedia="IconicStealer",misp-galaxy:tool="ICONICSTEALER",misp-galaxy:tool="DAVESHELL",misp-galaxy:tool="SIGFLIP",misp-galaxy:backdoor="VEILEDSIGNAL",misp-galaxy:tool="COLDCAT",misp-galaxy:tool="TAXHAUL"