import "hash" rule bulwark_https_bulwarkblack_com_google_and_mandiant_disrupt_gridtide_chinese_apt_espionage_campai { meta: author = "Bulwark Black LLC" source = "https://bulwarkblack.com/google-and-mandiant-disrupt-gridtide-chinese-apt-espionage-campaign-compromises-53-victims-in-42-countries/" description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule." generated = "2026-08-27T00:00:00Z" tlp = "TLP:CLEAR" indicator_count = "241" strings: $s0 = "1cv2f3d5s6a9w.ddnsfree.com" ascii wide nocase // Domains $s1 = "accesscam.org" ascii wide nocase // Domains $s2 = "admina.freeddns.org" ascii wide nocase // Domains $s3 = "afsaces.accesscam.org" ascii wide nocase // Domains $s4 = "ancisesic.accesscam.org" ascii wide nocase // Domains $s5 = "applebox.camdvr.org" ascii wide nocase // Domains $s6 = "appler.kozow.com" ascii wide nocase // Domains $s7 = "asdad21ww.freeddns.org" ascii wide nocase // Domains $s8 = "aw2o25forsbc.camdvr.org" ascii wide nocase // Domains $s9 = "awcc001jdaigfwdagdcew.giize.com" ascii wide nocase // Domains $s10 = "bab2o25com.accesscam.org" ascii wide nocase // Domains $s11 = "babaji.accesscam.org" ascii wide nocase // Domains $s12 = "babi5599ss.ddnsgeek.com" ascii wide nocase // Domains $s13 = "balabalabo.mywire.org" ascii wide nocase // Domains $s14 = "bggs.giize.com" ascii wide nocase // Domains $s15 = "bibabo.freeddns.org" ascii wide nocase // Domains $s16 = "binmol.webredirect.org" ascii wide nocase // Domains $s17 = "bioth.giize.com" ascii wide nocase // Domains $s18 = "boemobww.ddnsfree.com" ascii wide nocase // Domains $s19 = "brcallletme.theworkpc.com" ascii wide nocase // Domains $s20 = "btbtutil.theworkpc.com" ascii wide nocase // Domains $s21 = "btltan.ooguy.com" ascii wide nocase // Domains $s22 = "bumbleshrimp.com" ascii wide nocase // Domains $s23 = "camcampkes.ddnsfree.com" ascii wide nocase // Domains $s24 = "camdvr.org" ascii wide nocase // Domains $s25 = "camsqewivo.kozow.com" ascii wide nocase // Domains $s26 = "casacam.net" ascii wide nocase // Domains $s27 = "ccammutom.ddnsgeek.com" ascii wide nocase // Domains $s28 = "cdnvmtools.theworkpc.com" ascii wide nocase // Domains $s29 = "cloacpae.ddnsfree.com" ascii wide nocase // Domains $s30 = "cmwwoods1.theworkpc.com" ascii wide nocase // Domains $s31 = "cnrpaslceas.freeddns.org" ascii wide nocase // Domains $s32 = "codemicros12.gleeze.com" ascii wide nocase // Domains $s33 = "cressmiss.ooguy.com" ascii wide nocase // Domains $s34 = "cvabiasbae.ddnsfree.com" ascii wide nocase // Domains $s35 = "cvnoc01da1cjmnftsd.accesscam.org" ascii wide nocase // Domains $s36 = "cvpc01aenusocirem.accesscam.org" ascii wide nocase // Domains $s37 = "cvpc01cgsdfn53hgd.giize.com" ascii wide nocase // Domains $s38 = "dclcwpdtsdcc.ddnsfree.com" ascii wide nocase // Domains $s39 = "ddnsfree.com" ascii wide nocase // Domains $s40 = "ddnsgeek.com" ascii wide nocase // Domains $s41 = "dlpossie.ddnsfree.com" ascii wide nocase // Domains $s42 = "dnsfreedb.ddnsfree.com" ascii wide nocase // Domains $s43 = "doboudix1024.mywire.org" ascii wide nocase // Domains $s44 = "dynuddns.net" ascii wide nocase // Domains $s45 = "evilginx2.loseyourip.com" ascii wide nocase // Domains $s46 = "examp1e.webredirect.org" ascii wide nocase // Domains $s47 = "faeelt.giize.com" ascii wide nocase // Domains $s48 = "fakjcsaeyhs.ddnsfree.com" ascii wide nocase // Domains $s49 = "fasceadvcva3.gleeze.com" ascii wide nocase // Domains $s50 = "ffosies2024.camdvr.org" ascii wide nocase // Domains $s51 = "fgdedd1dww.gleeze.com" ascii wide nocase // Domains $s52 = "filipinet.ddnsgeek.com" ascii wide nocase // Domains $s53 = "freeios.theworkpc.com" ascii wide nocase // Domains $s54 = "ftpuser14.gleeze.com" ascii wide nocase // Domains $s55 = "ftpzpak.kozow.com" ascii wide nocase // Domains $s56 = "giize.com" ascii wide nocase // Domains $s57 = "gleeze.com" ascii wide nocase // Domains $s58 = "globoss.kozow.com" ascii wide nocase // Domains $s59 = "gogo2025up.ddnsfree.com" ascii wide nocase // Domains $s60 = "googlel.gleeze.com" ascii wide nocase // Domains $s61 = "googles.accesscam.org" ascii wide nocase // Domains $s62 = "googles.ddnsfree.com" ascii wide nocase // Domains $s63 = "googlett.camdvr.org" ascii wide nocase // Domains $s64 = "googllabwws.gleeze.com" ascii wide nocase // Domains $s65 = "gtaldps31c.ddnsfree.com" ascii wide nocase // Domains $s66 = "hamkorg.kozow.com" ascii wide nocase // Domains $s67 = "honidoo.loseyourip.com" ascii wide nocase // Domains $s68 = "huygdr12.loseyourip.com" ascii wide nocase // Domains $s69 = "icekancusjhea.ddnsgeek.com" ascii wide nocase // Domains $s70 = "idstandsuui.kozow.com" ascii wide nocase // Domains $s71 = "indoodchat.theworkpc.com" ascii wide nocase // Domains $s72 = "jarvis001.freeddns.org" ascii wide nocase // Domains $s73 = "kaushalya.freeddns.org" ascii wide nocase // Domains $s74 = "khyes001ndfpnuewdm.kozow.com" ascii wide nocase // Domains $s75 = "kozow.com" ascii wide nocase // Domains $s76 = "kskxoscieontrolanel.gleeze.com" ascii wide nocase // Domains $s77 = "ksv01sokudwongsj.theworkpc.com" ascii wide nocase // Domains $s78 = "lcskiecjj.loseyourip.com" ascii wide nocase // Domains $s79 = "lcskiecs.ddnsfree.com" ascii wide nocase // Domains $s80 = "loseyourip.com" ascii wide nocase // Domains $s81 = "losiesca.ddnsgeek.com" ascii wide nocase // Domains $s82 = "lps2staging.ddnsfree.com" ascii wide nocase // Domains $s83 = "lsls.casacam.net" ascii wide nocase // Domains $s84 = "ltiuys.ddnsgeek.com" ascii wide nocase // Domains $s85 = "ltiuys.kozow.com" ascii wide nocase // Domains $s86 = "mailsdy.gleeze.com" ascii wide nocase // Domains $s87 = "maliclick1.ddnsfree.com" ascii wide nocase // Domains $s88 = "mauritasszddb.ddnsfree.com" ascii wide nocase // Domains $s89 = "meetls.kozow.com" ascii wide nocase // Domains $s90 = "microsoft.bumbleshrimp.com" ascii wide nocase // Domains $s91 = "ml3.freeddns.org" ascii wide nocase // Domains $s92 = "mlksucnayesk.kozow.com" ascii wide nocase // Domains $s93 = "mmmfaco2025.mywire.org" ascii wide nocase // Domains $s94 = "mms.bumbleshrimp.com" ascii wide nocase // Domains $s95 = "mmvmtools.giize.com" ascii wide nocase // Domains $s96 = "modgood.gleeze.com" ascii wide nocase // Domains $s97 = "mosplosaq.accesscam.org" ascii wide nocase // Domains $s98 = "mysql.casacam.net" ascii wide nocase // Domains $s99 = "mywire.org" ascii wide nocase // Domains $s100 = "nenigncagvawr.giize.com" ascii wide nocase // Domains $s101 = "nenignenigoncqvoo.ooguy.com" ascii wide nocase // Domains $s102 = "nenigoncqnutgo.accesscam.org" ascii wide nocase // Domains $s103 = "nenigoncuopzc.giize.com" ascii wide nocase // Domains $s104 = "nims.gleeze.com" ascii wide nocase // Domains $s105 = "nisaldwoa.theworkpc.com" ascii wide nocase // Domains $s106 = "nmszablogs.ddnsfree.com" ascii wide nocase // Domains $s107 = "nodekeny11.freeddns.org" ascii wide nocase // Domains $s108 = "nodjs2o25nodjs.giize.com" ascii wide nocase // Domains $s109 = "npeoples.theworkpc.com" ascii wide nocase // Domains $s110 = "officeshan.kozow.com" ascii wide nocase // Domains $s111 = "okkstt.ddnsgeek.com" ascii wide nocase // Domains $s112 = "oldatain1.ddnsgeek.com" ascii wide nocase // Domains $s113 = "onlyosun.ooguy.com" ascii wide nocase // Domains $s114 = "ooguy.com" ascii wide nocase // Domains $s115 = "osix.ddnsgeek.com" ascii wide nocase // Domains $s116 = "ovmmiuy.mywire.org" ascii wide nocase // Domains $s117 = "palamolscueajfvc.gleeze.com" ascii wide nocase // Domains $s118 = "pawanp.kozow.com" ascii wide nocase // Domains $s119 = "pcmainecia.ddnsfree.com" ascii wide nocase // Domains $s120 = "pcvmts3.kozow.com" ascii wide nocase // Domains $s121 = "peisuesacae.loseyourip.com" ascii wide nocase // Domains $s122 = "peowork.ddnsgeek.com" ascii wide nocase // Domains $s123 = "pepesetup.ddnsfree.com" ascii wide nocase // Domains $s124 = "pewsus.freeddns.org" ascii wide nocase // Domains $s125 = "plcoaweniva.ddnsgeek.com" ascii wide nocase // Domains $s126 = "policyagent.theworkpc.com" ascii wide nocase // Domains $s127 = "polokinyea.gleeze.com" ascii wide nocase // Domains $s128 = "pplodsssead222.loseyourip.com" ascii wide nocase // Domains $s129 = "pplosad231.kozow.com" ascii wide nocase // Domains $s130 = "ppsabedon.gleeze.com" ascii wide nocase // Domains $s131 = "prdanjana01.ddnsfree.com" ascii wide nocase // Domains $s132 = "prepaid127.freeddns.org" ascii wide nocase // Domains $s133 = "priftp.kozow.com" ascii wide nocase // Domains $s134 = "prihxlcs.ddnsfree.com" ascii wide nocase // Domains $s135 = "prihxlcsw.theworkpc.com" ascii wide nocase // Domains $s136 = "pxlaxvvva.freeddns.org" ascii wide nocase // Domains $s137 = "quitgod2023luck.giize.com" ascii wide nocase // Domains $s138 = "rabbit.ooguy.com" ascii wide nocase // Domains $s139 = "rsm323.kozow.com" ascii wide nocase // Domains $s140 = "saf3asg.giize.com" ascii wide nocase // Domains $s141 = "scopps.ddnsgeek.com" ascii wide nocase // Domains $s142 = "sdhite43.ddnsfree.com" ascii wide nocase // Domains $s143 = "sdsuytoins63.kozow.com" ascii wide nocase // Domains $s144 = "selfad.gleeze.com" ascii wide nocase // Domains $s145 = "serious.kozow.com" ascii wide nocase // Domains $s146 = "setupcodpr2.freeddns.org" ascii wide nocase // Domains $s147 = "sgsn.accesscam.org" ascii wide nocase // Domains $s148 = "smartfren.giize.com" ascii wide nocase // Domains $s149 = "sn0son4t31bbsvopou.camdvr.org" ascii wide nocase // Domains $s150 = "sn0son4t31opc.freeddns.org" ascii wide nocase // Domains $s151 = "soovuy.gleeze.com" ascii wide nocase // Domains $s152 = "styuij.mywire.org" ascii wide nocase // Domains $s153 = "supceasfg1.loseyourip.com" ascii wide nocase // Domains $s154 = "systemsz.kozow.com" ascii wide nocase // Domains $s155 = "t31c0mjumpcuyerop.ooguy.com" ascii wide nocase // Domains $s156 = "t31c0mopamcuiomx.kozow.com" ascii wide nocase // Domains $s157 = "t31c0mopmiuewklg.webredirect.org" ascii wide nocase // Domains $s158 = "t31c0mopocuveop.accesscam.org" ascii wide nocase // Domains $s159 = "t3lc0mcanyqbfac.loseyourip.com" ascii wide nocase // Domains $s160 = "t3lc0mczmoihwc.camdvr.org" ascii wide nocase // Domains $s161 = "t3lc0mh4udncifw.casacam.net" ascii wide nocase // Domains $s162 = "t3lc0mhasvnctsk.giize.com" ascii wide nocase // Domains $s163 = "t3lm0rtlcagratu.kozow.com" ascii wide nocase // Domains $s164 = "tch.giize.com" ascii wide nocase // Domains $s165 = "telcomn.giize.com" ascii wide nocase // Domains $s166 = "telen.bumbleshrimp.com" ascii wide nocase // Domains $s167 = "telkom.ooguy.com" ascii wide nocase // Domains $s168 = "telkomservices.theworkpc.com" ascii wide nocase // Domains $s169 = "thbio.kozow.com" ascii wide nocase // Domains $s170 = "theworkpc.com" ascii wide nocase // Domains $s171 = "timpe.kozow.com" ascii wide nocase // Domains $s172 = "timpe.webredirect.org" ascii wide nocase // Domains $s173 = "tlse001hdfuwwgdgpnn.theworkpc.com" ascii wide nocase // Domains $s174 = "tltlsktelko.ddnsfree.com" ascii wide nocase // Domains $s175 = "transport.dynuddns.net" ascii wide nocase // Domains $s176 = "trvcl.bumbleshrimp.com" ascii wide nocase // Domains $s177 = "ttsiou12.loseyourip.com" ascii wide nocase // Domains $s178 = "ua2o25yth.ddnsgeek.com" ascii wide nocase // Domains $s179 = "udieyg.gleeze.com" ascii wide nocase // Domains $s180 = "unnjunnani.ddnsfree.com" ascii wide nocase // Domains $s181 = "updatamail.kozow.com" ascii wide nocase // Domains $s182 = "updatasuccess.ddnsgeek.com" ascii wide nocase // Domains $s183 = "updateservices.kozow.com" ascii wide nocase // Domains $s184 = "updatetools.giize.com" ascii wide nocase // Domains $s185 = "uscplxsecjs.ddnsgeek.com" ascii wide nocase // Domains $s186 = "usoshared1.ddnsfree.com" ascii wide nocase // Domains $s187 = "vals.bumbleshrimp.com" ascii wide nocase // Domains $s188 = "vass.ooguy.com" ascii wide nocase // Domains $s189 = "vass2025.casacam.net" ascii wide nocase // Domains $s190 = "vmtools.camdvr.org" ascii wide nocase // Domains $s191 = "vmtools.loseyourip.com" ascii wide nocase // Domains $s192 = "vosies.ddnsfree.com" ascii wide nocase // Domains $s193 = "vpaspmine.freeddns.org" ascii wide nocase // Domains $s194 = "wdlcamaakc.ooguy.com" ascii wide nocase // Domains $s195 = "winfoss1.kozow.com" ascii wide nocase // Domains $s196 = "ysiohbk.camdvr.org" ascii wide nocase // Domains $s197 = "zammffayhd.ddnsfree.com" ascii wide nocase // Domains $s198 = "zmcmvmbm.ddnsfree.com" ascii wide nocase // Domains $s199 = "zwmn350n3o1fsdf3gs.kozow.com" ascii wide nocase // Domains $s200 = "zwmn350n3o1ugety2xbe.camdvr.org" ascii wide nocase // Domains $s201 = "zwmn350n3o1vsdrggs.ddnsfree.com" ascii wide nocase // Domains $s202 = "zwt310n3o1unety2kab.webredirect.org" ascii wide nocase // Domains $s203 = "zwt310n3o2unety6a3k.kozow.com" ascii wide nocase // Domains $s204 = "zwt31n3t0nidoqmve.camdvr.org" ascii wide nocase // Domains $s205 = "zwt3ln3t1aimckalw.theworkpc.com" ascii wide nocase // Domains $s206 = "http://130.94.6.228/amp.tar.gz" ascii wide nocase // URLs $s207 = "http://130.94.6.228/apt.tar.gz" ascii wide nocase // URLs $s208 = "http://130.94.6.228/update.tar.gz" ascii wide nocase // URLs $s209 = "130.94.6.228" ascii wide nocase // IPv4 $s210 = "139.180.219.115" ascii wide nocase // IPv4 $s211 = "139.84.236.237" ascii wide nocase // IPv4 $s212 = "149.28.128.128" ascii wide nocase // IPv4 $s213 = "149.28.139.125" ascii wide nocase // IPv4 $s214 = "178.79.188.181" ascii wide nocase // IPv4 $s215 = "195.123.211.70" ascii wide nocase // IPv4 $s216 = "195.123.226.235" ascii wide nocase // IPv4 $s217 = "202.59.10.122" ascii wide nocase // IPv4 $s218 = "207.148.73.18" ascii wide nocase // IPv4 $s219 = "38.180.205.14" ascii wide nocase // IPv4 $s220 = "38.54.112.184" ascii wide nocase // IPv4 $s221 = "38.54.31.146" ascii wide nocase // IPv4 $s222 = "38.54.32.244" ascii wide nocase // IPv4 $s223 = "38.54.37.196" ascii wide nocase // IPv4 $s224 = "38.54.82.69" ascii wide nocase // IPv4 $s225 = "38.60.171.242" ascii wide nocase // IPv4 $s226 = "38.60.194.21" ascii wide nocase // IPv4 $s227 = "38.60.224.25" ascii wide nocase // IPv4 $s228 = "38.60.252.66" ascii wide nocase // IPv4 $s229 = "45.76.157.113" ascii wide nocase // IPv4 $s230 = "45.76.184.214" ascii wide nocase // IPv4 $s231 = "45.77.254.168" ascii wide nocase // IPv4 $s232 = "45.90.59.129" ascii wide nocase // IPv4 $s233 = "5.34.176.6" ascii wide nocase // IPv4 $s234 = "65.20.104.91" ascii wide nocase // IPv4 condition: any of ($s*) or hash.sha256(0, filesize) == "01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb" or hash.sha256(0, filesize) == "4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9" or hash.sha256(0, filesize) == "669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966" or hash.sha256(0, filesize) == "ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47" or hash.sha256(0, filesize) == "d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606" or hash.sha256(0, filesize) == "eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033" }