rule bulwark_https_bulwarkblack_com_diesel_vortex_russian_cybercrime_group_steals_1600_credentials_fr
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/diesel-vortex-russian-cybercrime-group-steals-1600-credentials-from-global-logistics-sector/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:30:59Z"
        tlp = "TLP:CLEAR"
        indicator_count = "21"
    strings:
        $s0 = "USCARGOEXPRESSyahoo.com" ascii wide nocase  // Domains
        $s1 = "ernigr-esfilc.com" ascii wide nocase  // Domains
        $s2 = "globalprofit-lpanel-abcdefghij.top" ascii wide nocase  // Domains
        $s3 = "ipinfo.io" ascii wide nocase  // Domains
        $s4 = "lpanel-bckaoplsks.top" ascii wide nocase  // Domains
        $s5 = "lpanel-bumaepxuje-iframe.top" ascii wide nocase  // Domains
        $s6 = "lpanel-bumaepxuje.top" ascii wide nocase  // Domains
        $s7 = "lpanel-kkbnukltpo.top" ascii wide nocase  // Domains
        $s8 = "ns1.suspended-domain.com" ascii wide nocase  // Domains
        $s9 = "penskecar.riersrmissecured.com" ascii wide nocase  // Domains
        $s10 = "penskecar.rsrmissecured.top" ascii wide nocase  // Domains
        $s11 = "riersrmissecured.com" ascii wide nocase  // Domains
        $s12 = "rsrmissecured.top" ascii wide nocase  // Domains
        $s13 = "suspended-domain.com" ascii wide nocase  // Domains
        $s14 = "t.me" ascii wide nocase  // Domains
        $s15 = "yasomawork.space" ascii wide nocase  // Domains
        $s16 = "ernigr-esfilc.com/security/logon[" ascii wide nocase  // URLs
        $s17 = "https://ernigr-esfilc.com/security/logon.jsp?verify=7g2q978fg11jka=891FHjaH32-2f1Hnb2sF" ascii wide nocase  // URLs
        $s18 = "https://penskecar.riersrmissecured.com/_c/cstm/4325/reg/DOTLookup.aspx" ascii wide nocase  // URLs
        $s19 = "https://rsrmissecured.top/.git/config" ascii wide nocase  // URLs
        $s20 = "penskecar.riersrmissecured.com/_c/cstm/4325/reg/DOTLookup.aspx" ascii wide nocase  // URLs
    condition:
        any of ($s*)
}