rule bulwark_https_bulwarkblack_com_infostealer_infection_unmasks_dprk_operative_behind_polyfill_io_s
{
    meta:
        author = "Bulwark Black LLC"
        source = "https://bulwarkblack.com/infostealer-infection-unmasks-dprk-operative-behind-polyfill-io-supply-chain-attack-and-us-crypto-exchange-infiltration/"
        description = "Auto-extracted indicators. Verify before use; not a behavioral detection rule."
        generated = "2026-07-15T22:32:06Z"
        tlp = "TLP:CLEAR"
        indicator_count = "32"
    strings:
        $s0 = "Gate.io" ascii wide nocase  // Domains
        $s1 = "Gate.us" ascii wide nocase  // Domains
        $s2 = "Polyfill.io" ascii wide nocase  // Domains
        $s3 = "apps.nulab.com" ascii wide nocase  // Domains
        $s4 = "cctest.kk5yuzmev2qbgulz.com" ascii wide nocase  // Domains
        $s5 = "cockpit.sumsub.com" ascii wide nocase  // Domains
        $s6 = "discord.com" ascii wide nocase  // Domains
        $s7 = "feee.io" ascii wide nocase  // Domains
        $s8 = "friday.stark-industries.solutions" ascii wide nocase  // Domains
        $s9 = "gy4q3fpx3gh77gw.kk5yuzmev2qbgulz.com" ascii wide nocase  // Domains
        $s10 = "kk5yuzmev2qbgulz.com" ascii wide nocase  // Domains
        $s11 = "lrtechs.backlog.com" ascii wide nocase  // Domains
        $s12 = "lrtechs.co" ascii wide nocase  // Domains
        $s13 = "lrtechs.co.jp" ascii wide nocase  // Domains
        $s14 = "polyfill.com" ascii wide nocase  // Domains
        $s15 = "polyfill.io" ascii wide nocase  // Domains
        $s16 = "polyfillcache.com" ascii wide nocase  // Domains
        $s17 = "stark-industries.solutions" ascii wide nocase  // Domains
        $s18 = "t2.funnull.host" ascii wide nocase  // Domains
        $s19 = "vision.stark-industries.solutions" ascii wide nocase  // Domains
        $s20 = "www.hudsonrock.com" ascii wide nocase  // Domains
        $s21 = "www.mediafire.com" ascii wide nocase  // Domains
        $s22 = "funnull.host" ascii wide nocase  // URLs
        $s23 = "https://apps.nulab.com/signup/verify" ascii wide nocase  // URLs
        $s24 = "https://cockpit.sumsub.com/checkus#/applicant/66a453df5137ba3da8742f58/basicInfo?clientId=gate.us_60664" ascii wide nocase  // URLs
        $s25 = "https://discord.com/register" ascii wide nocase  // URLs
        $s26 = "https://gy4q3fpx3gh77gw.kk5yuzmev2qbgulz.com/#/domin/list" ascii wide nocase  // URLs
        $s27 = "https://lrtechs.backlog.com/dashboard" ascii wide nocase  // URLs
        $s28 = "https://vision.stark-industries.solutions/auth/login" ascii wide nocase  // URLs
        $s29 = "https://www.hudsonrock.com/schedule-demo" ascii wide nocase  // URLs
        $s30 = "https://www.mediafire.com/file/gflsp6ovigjnvms/@#Full_Istaller_Pc_Setup_2024_PaSSW%E1%B9%8FrD^$.zip/file" ascii wide nocase  // URLs
        $s31 = "192.161.60.132" ascii wide nocase  // IPv4
    condition:
        any of ($s*)
}