import "hash"

rule bulwark_https_bulwarkblack_com_operation_truechaos_chinese_apt_exploits_trueconf_zero_day_cve_20
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/operation-truechaos-chinese-apt-exploits-trueconf-zero-day-cve-2026-3502-to-target-southeast-asian-governments/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-08-27T05:25:18Z"
        tlp = "TLP:CLEAR"
        indicator_count = "8"
    strings:
        $s0 = "trueconf.com" ascii wide nocase  // Domains
        $s1 = "https://trueconf.com/docs/server/en/admin/info/" ascii wide nocase  // URLs
        $s2 = "43.134.52.221" ascii wide nocase  // IPv4
        $s3 = "43.134.90.60" ascii wide nocase  // IPv4
        $s4 = "47.237.15.197" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.md5(0, filesize) == "22e32bcf113326e366ac480b077067cf" or
        hash.md5(0, filesize) == "248a4d7d4c48478dcbeade8f7dba80b3" or
        hash.md5(0, filesize) == "9b435ad985b733b64a6d5f39080f4ae0"
}