// Selected evidence-qualified indicators only; not the complete article IOC inventory.
// Source context is not a confirmed-malicious verdict; verify before operational use.
import "hash"

rule bulwark_https_bulwarkblack_com_apt29_poisoned_source_mobile_watering_holes_session_recovery
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/apt29-poisoned-source-mobile-watering-holes-session-recovery/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-11-04T10:14:09Z"
        tlp = "TLP:CLEAR"
        indicator_count = "34"
    strings:
        $s0 = "a.plerdy.com" ascii wide nocase  // Domains
        $s1 = "ad.starx-net.com" ascii wide nocase  // Domains
        $s2 = "ads-it-assets.com" ascii wide nocase  // Domains
        $s3 = "adsprism-stat.com" ascii wide nocase  // Domains
        $s4 = "america250.holiday" ascii wide nocase  // Domains
        $s5 = "assets-int.com" ascii wide nocase  // Domains
        $s6 = "cdn.adv-static.com" ascii wide nocase  // Domains
        $s7 = "clouds-stacks.com" ascii wide nocase  // Domains
        $s8 = "edge-ord.clouds-stacks.com" ascii wide nocase  // Domains
        $s9 = "flux-telemetry.com" ascii wide nocase  // Domains
        $s10 = "plerdy.com" ascii wide nocase  // Domains
        $s11 = "starx-net.com" ascii wide nocase  // Domains
        $s12 = "static.flux-telemetry.com" ascii wide nocase  // Domains
        $s13 = "theowo.club" ascii wide nocase  // Domains
        $s14 = "wpvortex-mod.com" ascii wide nocase  // Domains
        $s15 = "https://a.plerdy.com/public/js/click/main.js" ascii wide nocase  // URLs
        $s16 = "https://ad.starx-net.com/api/" ascii wide nocase  // URLs
        $s17 = "https://ad.starx-net.com:8881/telemetry/v12" ascii wide nocase  // URLs
        $s18 = "https://edge-ord.clouds-stacks.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js" ascii wide nocase  // URLs
        $s19 = "https://static.flux-telemetry.com/module/5b4c8fea5cbcee273e8d830f52-temfp.js" ascii wide nocase  // URLs
        $s20 = "109.104.106.107" ascii wide nocase  // IPv4
        $s21 = "188.190.17.232" ascii wide nocase  // IPv4
        $s22 = "192.121.46.25" ascii wide nocase  // IPv4
        $s23 = "195.58.140.105" ascii wide nocase  // IPv4
        $s24 = "95.133.231.28" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "06c17b31d36838f3d29044784aa047d5c2d9174d3356c1211cf25f9df677445f" or
        hash.sha256(0, filesize) == "183d62d682aea8018491c8559544e8d6a9ab0e1abd05ecbb6c97daa4f438d2b8" or
        hash.sha256(0, filesize) == "29d283ebd08d0cd3b2e6f4a67718d3d6e7a6be01d0613d716bce218dba57a928" or
        hash.sha256(0, filesize) == "2ffb35e3f9e55286a930fb887e73764a913166648135fe0ca7551736d97d7bfa" or
        hash.sha256(0, filesize) == "387a7fb768db1350a9788d9704e7a72abe07152734e0ff026af72b417e36268c" or
        hash.sha256(0, filesize) == "69b6cb327a4d5da99399718f6a66f84de69f89425b0a31f2dcee0682f811596f" or
        hash.sha256(0, filesize) == "a7d2493df00565c21587b0cad2a9fe7ca1e5590acf796da6e499be0ffde44cc3" or
        hash.sha256(0, filesize) == "bee3e014e3df87ddce0250b0985b87f6868a427a7b650a74b7ffedb9d57f3088" or
        hash.sha256(0, filesize) == "c170fda024183645c0aa681149304e50506509c3498bb6b9a5f5ced6aa73e5fa"
}