{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/financially-motivated-threat-actors-misusing-app-installer/",
    "fang": "live",
    "exported_at": "2026-07-15T22:31:18Z",
    "total": 82,
    "categories": 4
  },
  "iocs": {
    "Domains": [
      "1204knos.ru",
      "1204networks.ru",
      "abobe.ithr.org",
      "aka.ms",
      "amgreetings.tech",
      "amgreetings.tech-department.us",
      "amydeks.ithr.org",
      "api.store",
      "cabotcorpsupport-my.sharepoint.com",
      "cbre.tech",
      "cbre.tech-department.us",
      "formeld.tech",
      "formeld.tech-department.us",
      "gertefin.com",
      "hubergroup.tech",
      "hubergroup.tech-department.us",
      "info-zoomapp.com",
      "kellyhrservices-my.sharepoint.com",
      "kellyservices-hr.com",
      "kellyservicesheadhunter-my.sharepoint.com",
      "kellyserviceshr-my.sharepoint.com",
      "kellyservicesrecruitmentdep-my.sharepoint.com",
      "mckinseyhrcompany-my.sharepoint.com",
      "meetlng.group",
      "nixonpeabody.tech",
      "nixonpeabody.tech-department.us",
      "perimeter81support-my.sharepoint.com",
      "scheta.site",
      "septcntr.com",
      "sharepoint.com",
      "storageplace.pro",
      "sun1.space",
      "tab1eu.ithr.org",
      "teannviewer.ithr.org",
      "tech-department.us",
      "thecyberwire.com",
      "tnetworkslicense.ru",
      "webmicrosoftservicesystem.com",
      "zoonn.ithr.org",
      "zoonn.meetlng.group"
    ],
    "URLs": [
      "1204knos.ru",
      "1204networks.ru",
      "amgreetings.tech-department.us",
      "cabotcorpsupport-my.sharepoint.com",
      "cbre.tech-department.us",
      "formeld.tech-department.us",
      "gertefin.com",
      "https://aka.ms/threatintelblog",
      "https://scheta.site/api.store/Setup.msix",
      "https://scheta.site/api.store/ZoomInstaller.msix",
      "https://thecyberwire.com/podcasts/microsoft-threat-intelligence",
      "hubergroup.tech-department.us",
      "info-zoomapp.com",
      "ithr.org",
      "kellyhrservices-my.sharepoint.com",
      "kellyservices-hr.com",
      "kellyservicesheadhunter-my.sharepoint.com",
      "kellyserviceshr-my.sharepoint.com",
      "kellyservicesrecruitmentdep-my.sharepoint.com",
      "mckinseyhrcompany-my.sharepoint.com",
      "nixonpeabody.tech-department.us",
      "perimeter81support-my.sharepoint.com",
      "scheta.site",
      "scheta.site/api.store/Setup.msix",
      "scheta.site/api.store/ZoomInstaller.msix",
      "septcntr.com",
      "storageplace.pro",
      "sun1.space",
      "tech-department.us",
      "tnetworkslicense.ru",
      "webmicrosoftservicesystem.com",
      "zoonn.meetlng.group"
    ],
    "sha256": [
      "06b4aebbc3cd62e0aadd1852102645f9a00cc7eea492c0939675efba7566a6de",
      "11b71429869f29122236a44a292fde3f0269cde8eb76a52c89139f79f4b97e63",
      "2ba527fb8e31cb209df8d1890a63cda9cd4433aa0b841ed8b86fa801aff4ccbd",
      "2ed5660c7b768b4c2a7899d00773af60cd4396f24a2f7d643ccc1bf74a403970",
      "44cac5bf0bab56b0840bd1c7b95f9c7f5078ff417705eeaaf5ea5a2167a81dd5",
      "48aa2393ef590bab4ff2fd1e7d95af36e5b6911348d7674347626c9aaafa255e",
      "7e646dfe7b7f330cb21db07b94f611eb39f604fab36e347fb884f797ba462402",
      "b79633917e51da2a4401473d08719f493d61fd64a1b10fe482c12d984d791ccb",
      "ffb45dc14ea908b21e01e87ec18725dff560c093884005c2b71277e2de354866"
    ],
    "CVEs": [
      "CVE-2021-43890"
    ]
  }
}