import "hash"

rule bulwark_https_bulwarkblack_com_google_disrupts_unc2814_gridtide_campaign_chinese_apt_breaches_53
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/google-disrupts-unc2814-gridtide-campaign-chinese-apt-breaches-53-organizations-across-42-countries/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:31:34Z"
        tlp = "TLP:CLEAR"
        indicator_count = "243"
    strings:
        $s0 = "1cv2f3d5s6a9w.ddnsfree.com" ascii wide nocase  // Domains
        $s1 = "Boemobww.ddnsfree.com" ascii wide nocase  // Domains
        $s2 = "DCLCWPDTSDCC.ddnsfree.com" ascii wide nocase  // Domains
        $s3 = "Kaushalya.freeddns.org" ascii wide nocase  // Domains
        $s4 = "Microsoft.bumbleshrimp.com" ascii wide nocase  // Domains
        $s5 = "Mosplosaq.accesscam.org" ascii wide nocase  // Domains
        $s6 = "Npeoples.theworkpc.com" ascii wide nocase  // Domains
        $s7 = "PRIFTP.kozow.com" ascii wide nocase  // Domains
        $s8 = "PolicyAgent.theworkpc.com" ascii wide nocase  // Domains
        $s9 = "Scopps.ddnsgeek.com" ascii wide nocase  // Domains
        $s10 = "Smartfren.giize.com" ascii wide nocase  // Domains
        $s11 = "USOShared1.ddnsfree.com" ascii wide nocase  // Domains
        $s12 = "accesscam.org" ascii wide nocase  // Domains
        $s13 = "admina.freeddns.org" ascii wide nocase  // Domains
        $s14 = "afsaces.accesscam.org" ascii wide nocase  // Domains
        $s15 = "ancisesic.accesscam.org" ascii wide nocase  // Domains
        $s16 = "applebox.camdvr.org" ascii wide nocase  // Domains
        $s17 = "appler.kozow.com" ascii wide nocase  // Domains
        $s18 = "asdad21ww.freeddns.org" ascii wide nocase  // Domains
        $s19 = "aw2o25forsbc.camdvr.org" ascii wide nocase  // Domains
        $s20 = "awcc001jdaigfwdagdcew.giize.com" ascii wide nocase  // Domains
        $s21 = "bab2o25com.accesscam.org" ascii wide nocase  // Domains
        $s22 = "babaji.accesscam.org" ascii wide nocase  // Domains
        $s23 = "babi5599ss.ddnsgeek.com" ascii wide nocase  // Domains
        $s24 = "balabalabo.mywire.org" ascii wide nocase  // Domains
        $s25 = "bggs.giize.com" ascii wide nocase  // Domains
        $s26 = "bibabo.freeddns.org" ascii wide nocase  // Domains
        $s27 = "binmol.webredirect.org" ascii wide nocase  // Domains
        $s28 = "bioth.giize.com" ascii wide nocase  // Domains
        $s29 = "brcallletme.theworkpc.com" ascii wide nocase  // Domains
        $s30 = "btbtutil.theworkpc.com" ascii wide nocase  // Domains
        $s31 = "btltan.ooguy.com" ascii wide nocase  // Domains
        $s32 = "bumbleshrimp.com" ascii wide nocase  // Domains
        $s33 = "camcampkes.ddnsfree.com" ascii wide nocase  // Domains
        $s34 = "camdvr.org" ascii wide nocase  // Domains
        $s35 = "camsqewivo.kozow.com" ascii wide nocase  // Domains
        $s36 = "casacam.net" ascii wide nocase  // Domains
        $s37 = "ccammutom.ddnsgeek.com" ascii wide nocase  // Domains
        $s38 = "cdnvmtools.theworkpc.com" ascii wide nocase  // Domains
        $s39 = "cloacpae.ddnsfree.com" ascii wide nocase  // Domains
        $s40 = "cmwwoods1.theworkpc.com" ascii wide nocase  // Domains
        $s41 = "cnrpaslceas.freeddns.org" ascii wide nocase  // Domains
        $s42 = "codemicros12.gleeze.com" ascii wide nocase  // Domains
        $s43 = "cressmiss.ooguy.com" ascii wide nocase  // Domains
        $s44 = "cvabiasbae.ddnsfree.com" ascii wide nocase  // Domains
        $s45 = "cvnoc01da1cjmnftsd.accesscam.org" ascii wide nocase  // Domains
        $s46 = "cvpc01aenusocirem.accesscam.org" ascii wide nocase  // Domains
        $s47 = "cvpc01cgsdfn53hgd.giize.com" ascii wide nocase  // Domains
        $s48 = "ddnsfree.com" ascii wide nocase  // Domains
        $s49 = "ddnsgeek.com" ascii wide nocase  // Domains
        $s50 = "dlpossie.ddnsfree.com" ascii wide nocase  // Domains
        $s51 = "dnsfreedb.ddnsfree.com" ascii wide nocase  // Domains
        $s52 = "doboudix1024.mywire.org" ascii wide nocase  // Domains
        $s53 = "dynuddns.net" ascii wide nocase  // Domains
        $s54 = "evilginx2.loseyourip.com" ascii wide nocase  // Domains
        $s55 = "examp1e.webredirect.org" ascii wide nocase  // Domains
        $s56 = "faeelt.giize.com" ascii wide nocase  // Domains
        $s57 = "fakjcsaeyhs.ddnsfree.com" ascii wide nocase  // Domains
        $s58 = "fasceadvcva3.gleeze.com" ascii wide nocase  // Domains
        $s59 = "ffosies2024.camdvr.org" ascii wide nocase  // Domains
        $s60 = "fgdedd1dww.gleeze.com" ascii wide nocase  // Domains
        $s61 = "filipinet.ddnsgeek.com" ascii wide nocase  // Domains
        $s62 = "freeddns.org" ascii wide nocase  // Domains
        $s63 = "freeios.theworkpc.com" ascii wide nocase  // Domains
        $s64 = "ftpuser14.gleeze.com" ascii wide nocase  // Domains
        $s65 = "ftpzpak.kozow.com" ascii wide nocase  // Domains
        $s66 = "giize.com" ascii wide nocase  // Domains
        $s67 = "gleeze.com" ascii wide nocase  // Domains
        $s68 = "globoss.kozow.com" ascii wide nocase  // Domains
        $s69 = "gogo2025up.ddnsfree.com" ascii wide nocase  // Domains
        $s70 = "googlel.gleeze.com" ascii wide nocase  // Domains
        $s71 = "googles.accesscam.org" ascii wide nocase  // Domains
        $s72 = "googles.ddnsfree.com" ascii wide nocase  // Domains
        $s73 = "googlett.camdvr.org" ascii wide nocase  // Domains
        $s74 = "googllabwws.gleeze.com" ascii wide nocase  // Domains
        $s75 = "gtaldps31c.ddnsfree.com" ascii wide nocase  // Domains
        $s76 = "hamkorg.kozow.com" ascii wide nocase  // Domains
        $s77 = "honidoo.loseyourip.com" ascii wide nocase  // Domains
        $s78 = "huygdr12.loseyourip.com" ascii wide nocase  // Domains
        $s79 = "icekancusjhea.ddnsgeek.com" ascii wide nocase  // Domains
        $s80 = "idstandsuui.kozow.com" ascii wide nocase  // Domains
        $s81 = "indoodchat.theworkpc.com" ascii wide nocase  // Domains
        $s82 = "jarvis001.freeddns.org" ascii wide nocase  // Domains
        $s83 = "khyes001ndfpnuewdm.kozow.com" ascii wide nocase  // Domains
        $s84 = "kozow.com" ascii wide nocase  // Domains
        $s85 = "kskxoscieontrolanel.gleeze.com" ascii wide nocase  // Domains
        $s86 = "ksv01sokudwongsj.theworkpc.com" ascii wide nocase  // Domains
        $s87 = "lcskiecjj.loseyourip.com" ascii wide nocase  // Domains
        $s88 = "lcskiecs.ddnsfree.com" ascii wide nocase  // Domains
        $s89 = "loseyourip.com" ascii wide nocase  // Domains
        $s90 = "losiesca.ddnsgeek.com" ascii wide nocase  // Domains
        $s91 = "lps2staging.ddnsfree.com" ascii wide nocase  // Domains
        $s92 = "lsls.casacam.net" ascii wide nocase  // Domains
        $s93 = "ltiuys.ddnsgeek.com" ascii wide nocase  // Domains
        $s94 = "ltiuys.kozow.com" ascii wide nocase  // Domains
        $s95 = "mailsdy.gleeze.com" ascii wide nocase  // Domains
        $s96 = "maliclick1.ddnsfree.com" ascii wide nocase  // Domains
        $s97 = "mauritasszddb.ddnsfree.com" ascii wide nocase  // Domains
        $s98 = "meetls.kozow.com" ascii wide nocase  // Domains
        $s99 = "ml3.freeddns.org" ascii wide nocase  // Domains
        $s100 = "mlksucnayesk.kozow.com" ascii wide nocase  // Domains
        $s101 = "mmmfaco2025.mywire.org" ascii wide nocase  // Domains
        $s102 = "mms.bumbleshrimp.com" ascii wide nocase  // Domains
        $s103 = "mmvmtools.giize.com" ascii wide nocase  // Domains
        $s104 = "modgood.gleeze.com" ascii wide nocase  // Domains
        $s105 = "mysql.casacam.net" ascii wide nocase  // Domains
        $s106 = "mywire.org" ascii wide nocase  // Domains
        $s107 = "nenigncagvawr.giize.com" ascii wide nocase  // Domains
        $s108 = "nenignenigoncqvoo.ooguy.com" ascii wide nocase  // Domains
        $s109 = "nenigoncqnutgo.accesscam.org" ascii wide nocase  // Domains
        $s110 = "nenigoncuopzc.giize.com" ascii wide nocase  // Domains
        $s111 = "nims.gleeze.com" ascii wide nocase  // Domains
        $s112 = "nisaldwoa.theworkpc.com" ascii wide nocase  // Domains
        $s113 = "nmszablogs.ddnsfree.com" ascii wide nocase  // Domains
        $s114 = "nodekeny11.freeddns.org" ascii wide nocase  // Domains
        $s115 = "nodjs2o25nodjs.giize.com" ascii wide nocase  // Domains
        $s116 = "officeshan.kozow.com" ascii wide nocase  // Domains
        $s117 = "okkstt.ddnsgeek.com" ascii wide nocase  // Domains
        $s118 = "oldatain1.ddnsgeek.com" ascii wide nocase  // Domains
        $s119 = "onlyosun.ooguy.com" ascii wide nocase  // Domains
        $s120 = "ooguy.com" ascii wide nocase  // Domains
        $s121 = "osix.ddnsgeek.com" ascii wide nocase  // Domains
        $s122 = "ovmmiuy.mywire.org" ascii wide nocase  // Domains
        $s123 = "palamolscueajfvc.gleeze.com" ascii wide nocase  // Domains
        $s124 = "pawanp.kozow.com" ascii wide nocase  // Domains
        $s125 = "pcmainecia.ddnsfree.com" ascii wide nocase  // Domains
        $s126 = "pcvmts3.kozow.com" ascii wide nocase  // Domains
        $s127 = "peisuesacae.loseyourip.com" ascii wide nocase  // Domains
        $s128 = "peowork.ddnsgeek.com" ascii wide nocase  // Domains
        $s129 = "pepesetup.ddnsfree.com" ascii wide nocase  // Domains
        $s130 = "pewsus.freeddns.org" ascii wide nocase  // Domains
        $s131 = "plcoaweniva.ddnsgeek.com" ascii wide nocase  // Domains
        $s132 = "polokinyea.gleeze.com" ascii wide nocase  // Domains
        $s133 = "pplodsssead222.loseyourip.com" ascii wide nocase  // Domains
        $s134 = "pplosad231.kozow.com" ascii wide nocase  // Domains
        $s135 = "ppsaBedon.gleeze.com" ascii wide nocase  // Domains
        $s136 = "prdanjana01.ddnsfree.com" ascii wide nocase  // Domains
        $s137 = "prepaid127.freeddns.org" ascii wide nocase  // Domains
        $s138 = "prihxlcs.ddnsfree.com" ascii wide nocase  // Domains
        $s139 = "prihxlcsw.theworkpc.com" ascii wide nocase  // Domains
        $s140 = "pxlaxvvva.freeddns.org" ascii wide nocase  // Domains
        $s141 = "quitgod2023luck.giize.com" ascii wide nocase  // Domains
        $s142 = "rabbit.ooguy.com" ascii wide nocase  // Domains
        $s143 = "rsm323.kozow.com" ascii wide nocase  // Domains
        $s144 = "saf3asg.giize.com" ascii wide nocase  // Domains
        $s145 = "sdhite43.ddnsfree.com" ascii wide nocase  // Domains
        $s146 = "sdsuytoins63.kozow.com" ascii wide nocase  // Domains
        $s147 = "selfad.gleeze.com" ascii wide nocase  // Domains
        $s148 = "serious.kozow.com" ascii wide nocase  // Domains
        $s149 = "setupcodpr2.freeddns.org" ascii wide nocase  // Domains
        $s150 = "sgsn.accesscam.org" ascii wide nocase  // Domains
        $s151 = "sn0son4t31bbsvopou.camdvr.org" ascii wide nocase  // Domains
        $s152 = "sn0son4t31opc.freeddns.org" ascii wide nocase  // Domains
        $s153 = "soovuy.gleeze.com" ascii wide nocase  // Domains
        $s154 = "styuij.mywire.org" ascii wide nocase  // Domains
        $s155 = "supceasfg1.loseyourip.com" ascii wide nocase  // Domains
        $s156 = "systemsz.kozow.com" ascii wide nocase  // Domains
        $s157 = "t31c0mjumpcuyerop.ooguy.com" ascii wide nocase  // Domains
        $s158 = "t31c0mopamcuiomx.kozow.com" ascii wide nocase  // Domains
        $s159 = "t31c0mopmiuewklg.webredirect.org" ascii wide nocase  // Domains
        $s160 = "t31c0mopocuveop.accesscam.org" ascii wide nocase  // Domains
        $s161 = "t3lc0mcanyqbfac.loseyourip.com" ascii wide nocase  // Domains
        $s162 = "t3lc0mczmoihwc.camdvr.org" ascii wide nocase  // Domains
        $s163 = "t3lc0mh4udncifw.casacam.net" ascii wide nocase  // Domains
        $s164 = "t3lc0mhasvnctsk.giize.com" ascii wide nocase  // Domains
        $s165 = "t3lm0rtlcagratu.kozow.com" ascii wide nocase  // Domains
        $s166 = "tch.giize.com" ascii wide nocase  // Domains
        $s167 = "telcomn.giize.com" ascii wide nocase  // Domains
        $s168 = "telen.bumbleshrimp.com" ascii wide nocase  // Domains
        $s169 = "telkom.ooguy.com" ascii wide nocase  // Domains
        $s170 = "telkomservices.theworkpc.com" ascii wide nocase  // Domains
        $s171 = "thbio.kozow.com" ascii wide nocase  // Domains
        $s172 = "theworkpc.com" ascii wide nocase  // Domains
        $s173 = "timpe.kozow.com" ascii wide nocase  // Domains
        $s174 = "timpe.webredirect.org" ascii wide nocase  // Domains
        $s175 = "tlse001hdfuwwgdgpnn.theworkpc.com" ascii wide nocase  // Domains
        $s176 = "tltlsktelko.ddnsfree.com" ascii wide nocase  // Domains
        $s177 = "transport.dynuddns.net" ascii wide nocase  // Domains
        $s178 = "trvcl.bumbleshrimp.com" ascii wide nocase  // Domains
        $s179 = "ttsiou12.loseyourip.com" ascii wide nocase  // Domains
        $s180 = "ua2o25yth.ddnsgeek.com" ascii wide nocase  // Domains
        $s181 = "udieyg.gleeze.com" ascii wide nocase  // Domains
        $s182 = "unnjunnani.ddnsfree.com" ascii wide nocase  // Domains
        $s183 = "updatamail.kozow.com" ascii wide nocase  // Domains
        $s184 = "updatasuccess.ddnsgeek.com" ascii wide nocase  // Domains
        $s185 = "updateservices.kozow.com" ascii wide nocase  // Domains
        $s186 = "updatetools.giize.com" ascii wide nocase  // Domains
        $s187 = "uscplxsecjs.ddnsgeek.com" ascii wide nocase  // Domains
        $s188 = "vals.bumbleshrimp.com" ascii wide nocase  // Domains
        $s189 = "vass.ooguy.com" ascii wide nocase  // Domains
        $s190 = "vass2025.casacam.net" ascii wide nocase  // Domains
        $s191 = "vmtools.camdvr.org" ascii wide nocase  // Domains
        $s192 = "vmtools.loseyourip.com" ascii wide nocase  // Domains
        $s193 = "vosies.ddnsfree.com" ascii wide nocase  // Domains
        $s194 = "vpaspmine.freeddns.org" ascii wide nocase  // Domains
        $s195 = "wdlcamaakc.ooguy.com" ascii wide nocase  // Domains
        $s196 = "webredirect.org" ascii wide nocase  // Domains
        $s197 = "winfoss1.kozow.com" ascii wide nocase  // Domains
        $s198 = "ysiohbk.camdvr.org" ascii wide nocase  // Domains
        $s199 = "zammffayhd.ddnsfree.com" ascii wide nocase  // Domains
        $s200 = "zmcmvmbm.ddnsfree.com" ascii wide nocase  // Domains
        $s201 = "zwmn350n3o1fsdf3gs.kozow.com" ascii wide nocase  // Domains
        $s202 = "zwmn350n3o1ugety2xbe.camdvr.org" ascii wide nocase  // Domains
        $s203 = "zwmn350n3o1vsdrggs.ddnsfree.com" ascii wide nocase  // Domains
        $s204 = "zwt310n3o1unety2kab.webredirect.org" ascii wide nocase  // Domains
        $s205 = "zwt310n3o2unety6a3k.kozow.com" ascii wide nocase  // Domains
        $s206 = "zwt31n3t0nidoqmve.camdvr.org" ascii wide nocase  // Domains
        $s207 = "zwt3ln3t1aimckalw.theworkpc.com" ascii wide nocase  // Domains
        $s208 = "http://130.94.6.228/amp.tar.gz" ascii wide nocase  // URLs
        $s209 = "http://130.94.6.228/apt.tar.gz" ascii wide nocase  // URLs
        $s210 = "http://130.94.6.228/update.tar.gz" ascii wide nocase  // URLs
        $s211 = "130.94.6.228" ascii wide nocase  // IPv4
        $s212 = "139.180.219.115" ascii wide nocase  // IPv4
        $s213 = "139.84.236.237" ascii wide nocase  // IPv4
        $s214 = "149.28.128.128" ascii wide nocase  // IPv4
        $s215 = "149.28.139.125" ascii wide nocase  // IPv4
        $s216 = "178.79.188.181" ascii wide nocase  // IPv4
        $s217 = "195.123.211.70" ascii wide nocase  // IPv4
        $s218 = "195.123.226.235" ascii wide nocase  // IPv4
        $s219 = "202.59.10.122" ascii wide nocase  // IPv4
        $s220 = "207.148.73.18" ascii wide nocase  // IPv4
        $s221 = "38.180.205.14" ascii wide nocase  // IPv4
        $s222 = "38.54.112.184" ascii wide nocase  // IPv4
        $s223 = "38.54.31.146" ascii wide nocase  // IPv4
        $s224 = "38.54.32.244" ascii wide nocase  // IPv4
        $s225 = "38.54.37.196" ascii wide nocase  // IPv4
        $s226 = "38.54.82.69" ascii wide nocase  // IPv4
        $s227 = "38.60.171.242" ascii wide nocase  // IPv4
        $s228 = "38.60.194.21" ascii wide nocase  // IPv4
        $s229 = "38.60.224.25" ascii wide nocase  // IPv4
        $s230 = "38.60.252.66" ascii wide nocase  // IPv4
        $s231 = "45.76.157.113" ascii wide nocase  // IPv4
        $s232 = "45.76.184.214" ascii wide nocase  // IPv4
        $s233 = "45.77.254.168" ascii wide nocase  // IPv4
        $s234 = "45.90.59.129" ascii wide nocase  // IPv4
        $s235 = "5.34.176.6" ascii wide nocase  // IPv4
        $s236 = "65.20.104.91" ascii wide nocase  // IPv4
    condition:
        any of ($s*) or
        hash.sha256(0, filesize) == "01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb" or
        hash.sha256(0, filesize) == "4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9" or
        hash.sha256(0, filesize) == "669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966" or
        hash.sha256(0, filesize) == "ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47" or
        hash.sha256(0, filesize) == "d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606" or
        hash.sha256(0, filesize) == "eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033"
}